PAN-OS RCE CVE-2026-0322 exploited on firewalls

What Happened

Palo Alto Networks released security updates on Wednesday for a high-severity remote code execution vulnerability in PAN-OS, tracked as CVE-2026-0322. The company confirmed the flaw has been exploited in attacks targeting customer firewalls, making this an actively weaponized zero-day at the time of disclosure.

The vulnerability carries a CVSS score of 8.7 and affects the PAN-OS management web interface. Patches are available across supported PAN-OS branches, and Palo Alto has published indicators of compromise alongside its advisory.

This is the third PAN-OS vulnerability to see in-the-wild exploitation in recent months, following the GlobalProtect authentication bypass (CVE-2026-0257) and the unauthenticated RCE (CVE-2026-0300).

Why It Matters

Palo Alto firewalls sit at the perimeter of thousands of enterprise networks, and many are managed through the very interface affected by this flaw. A compromised firewall is not just a single-host incident - it is a position from which attackers can rewrite security policy, exfiltrate traffic, and pivot deeper into the network while disabling the controls meant to stop them.

The “authenticated” qualifier in the advisory should not invite complacency. Attackers with any foothold on a management network, a valid credential from prior phishing or credential-stuffing, or a chained exploit against a lesser flaw can satisfy the authentication requirement. Given that CVE-2026-0257 and CVE-2026-0300 both targeted the same platform, adversaries are clearly probing PAN-OS as a strategic target rather than opportunistically.

Technical Details

CVE-2026-0322 allows an authenticated attacker with access to the PAN-OS management web interface to execute arbitrary code with the privileges of the underlying service. Exploitation requires network reachability to the management plane and valid authentication, which confines the practical attack surface to internet-exposed management interfaces and threat actors who already hold credentials.

Palo Alto’s advisory lists the specific PAN-OS versions affected and the fixed releases for each branch. Organizations running unsupported end-of-life branches will not receive a patch and must either migrate or isolate those devices.

Indicators published with the advisory focus on unexpected processes, anomalous management-plane authentication events, and configuration changes that would not have originated from known administrators.

Immediate Risk

Exposed management interfaces are the highest-risk asset class right now. Any firewall with its management plane reachable from the internet, or from a broadly accessible internal segment, should be treated as potentially compromised until logs are reviewed. The combination of an authenticated RCE with an active exploitation campaign means the window between patch availability and mass scanning is measured in days, not weeks.

Prioritize patching internet-facing management interfaces first, then review authentication logs for the period before your patch was applied. Rotate administrative credentials and any secrets stored in firewall configuration.

Security Insight

The more useful signal here is the pattern, not the single CVE. Three exploited PAN-OS flaws in a compressed timeframe suggests adversaries are deliberately building a toolkit against one platform rather than spreading effort across many.

Compare this to the repeated CitrixBleed and Ivanti Connect Secure campaigns: once attackers find that a perimeter appliance yields high-value access at scale, they return to the same well. Defenders should assume further PAN-OS flaws will be exploited and shift from reactive patching to treating firewall management planes as tier-zero infrastructure - segmented, monitored, and never internet-exposed. If your management interface is reachable from the public internet today, that is the finding, regardless of which CVE is current.

Further Reading

• PAN-OS management RCE exploited in the wild (CVE-2026-0322)
• PAN-OS GlobalProtect auth bypass (CVE-2026-0257) [PoC]
• PAN-OS unauth RCE exploited in the wild (CVE-2026-0300) [PoC]
• Latest Security News
• CVE Advisories
• Data Breach Reports