What happened
Multiple organisations using Palo Alto Networks PAN-OS are advised of a critical vulnerability (CVE-2026-0322) that has been actively exploited in the wild. The vulnerability stems from a code injection flaw in the PAN-OS system, allowing an authenticated attacker with network access to execute arbitrary code with root privileges on affected firewalls. This security weakness, classified under CWE-94, poses a significant risk to system integrity and confidentiality.
Exploitation of this vulnerability enables malicious actors to potentially take full control of targeted firewalls, disrupting network security and operations. Immediate attention is required to mitigate these risks, as active exploitation indicates that threat actors are currently leveraging this weakness to compromise vulnerable systems. Due to the severity, prompt application of mitigations in accordance with vendor instructions is essential, following guidance issued by authorities such as CISA.
When the vulnerability was reported, it was confirmed that no official patches are yet available from the vendor. Organisations are therefore advised to follow recommended mitigation strategies, which include applying vendor-supplied controls and considering domiciling affected systems behind additional protective measures. For cloud-based deployments, or if mitigations cannot be implemented promptly, discontinuing use of the product is advised in line with BOD 26-04 guidance on prioritising security measures based on risk.
Who is affected
The vulnerability impacts organisations running Palo Alto Networks PAN-OS. Any such deployments that are accessible over the internet and lack sufficient safeguards are at increased risk of attack. Due to active exploitation reported by CISA KEV, systems exposed to unauthorised network access are particularly vulnerable. It remains the responsibility of stakeholders to assess the internet exposure of their assets and to ensure that appropriate security measures are in place to prevent unauthorised access and exploitation.
Recommended actions
Apply mitigations in accordance with vendor instructions as soon as they become available, and follow guidance outlined by CISA’s BOD 26-04 to prioritise updates based on risk.
Continually evaluate the internet exposure of affected systems, and restrict network access where possible to prevent unauthorised login attempts.
Discontinue use of affected deployments if mitigations are not available within the expected timeline, especially for critical infrastructure exposed to the public internet.
Review security controls to enforce strict authentication and network segmentation to minimise the attack surface.
