What happened
An active exploitation of a code injection vulnerability has been reported within Palo Alto Networks PAN-OS. The vulnerability allows an attacker with network access and prior privileged account access to execute arbitrary code with root privileges on the affected firewall system. The flaw is associated with CWE-94 and has been assigned CVE-2026-0322. Successful exploitation can result in high impact, with no user interaction required and the attacker needing only network reachability to the exposed service. The vulnerability impacts PAN-OS versions 12.2.0 up to just before 12.2.4, 12.1.0 up to before 12.1.10-h2, 11.2.0 up to before 11.2.16, and 11.1.0 up to before 11.1.16-h3. The exploit is confirmed to be active in the wild, underlining the urgency of remediation for affected deployments. A patch has been made available by the vendor to address the issue. The vulnerability is scored with a CVSS base score of 8.6, highlighting its severity. The exploit path involves directly attacking an exposed network service, requiring no action from any user, and necessitating high privileges for successful compromise. Mitigation measures include reducing network exposure of the vulnerable services, implementing effective segmentation, and establishing access controls to limit network reachability. Applying the vendor-provided fix is strongly recommended to eliminate the vulnerability from affected systems.
Who is affected
Any organisation running affected versions of Palo Alto Networks PAN-OS is at risk if the deployment is accessible over a network and the attacker has already acquired privileged account access. The vulnerability's active exploitation in the wild increases the threat level for affected networks, particularly those with exposed services that are reachable remotely.
Recommended actions
- Apply the latest available fix provided by the vendor to affected PAN-OS versions, as indicated in the vendor advisory.
- Implement network segmentation and restrict access to firewall management interfaces and other vulnerable services to trusted sources only.
- Review and tighten access controls to prevent unauthorised privileged account access, especially over exposed networks.
- Monitor network traffic for signs of exploitation activity related to this vulnerability.
