Palo Alto Networks has confirmed active exploitation of a high-severity PAN-OS flaw, CVE-2026-0322, that lets an authenticated attacker run code as root on firewalls and Panorama appliances. For UK infrastructure teams, this is a patch-today event, not a patch-this-sprint one — see our cyber security guidance below.
View the data behind this chart
| Phase | Starts (week) | Duration (weeks) |
|---|---|---|
| Advisory & patches released (14 Oct) | 0 | 1 |
| 11.2.16 fix due (15 Oct) | 1 | 1 |
| CISA KEV deadline (17 Oct) | 2 | 1 |
What Palo Alto Networks has confirmed
In a security advisory published on 14 October 2026, Palo Alto Networks disclosed that CVE-2026-0322, rated 8.6 on the CVSS scale, affects the PAN-OS management interface across PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access deployments are not affected.
The vendor stated it has seen "very limited exploitation" of the flaw, and published three IP addresses already linked to attacks: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. The flaw was found internally by Palo Alto researcher Suraj Siddharudh, not by an external incident, which suggests the vendor got ahead of public disclosure — but attackers were already exploiting it, with confirmed limited exploitation in the wild.
Why "authenticated" doesn't mean low risk
To exploit CVE-2026-0322, an attacker needs existing credentials and network access to the management interface. That caveat has led some teams to deprioritise similar advisories in the past, but it's the wrong instinct here. Credential theft, reused passwords, and phished admin accounts are routine in 2026, and once an attacker has valid access, this flaw hands them root — full control of the device, not just a management session.
UK organisations that still expose firewall management interfaces to the wider internet, or to broad internal VLANs rather than a hardened jump-host segment, are the ones most at risk. Palo Alto's own mitigation advice is to restrict the management interface to trusted internal IP addresses only, which should already be baseline practice under most zero trust network designs.
Patch status: what's fixed and what's still pending
Fixes are available now for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2, covering the bulk of supported deployments. A fix for PAN-OS 11.2.16 specifically was expected on 15 October 2026 — teams on that exact build should confirm the update has landed before considering themselves covered.
Customers running older, unsupported PAN-OS versions have no patch path and must upgrade to a supported release entirely. Palo Alto has confirmed there is no workaround for this vulnerability; customers with Threat Prevention subscriptions can enable signatures for known attack patterns, but the vendor itself warns this gives only partial coverage against variants of the exploit.
The compliance clock: CISA KEV and UK knock-on effects
CISA has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalogue, setting a remediation deadline of 17 October 2026 for US federal civilian agencies. UK public sector bodies and regulated firms aren't bound by that US deadline directly, but KEV listings are routinely used as a benchmark by cyber insurers, auditors and NCSC-aligned frameworks when assessing whether an organisation acted on known-exploited flaws in good time.
Firms that delay past a KEV listing date without a documented reason tend to face harder questions in post-incident reviews and renewal negotiations. Treat the 17 October marker as the practical ceiling for UK patching too, not a US-only formality.
Detection, segmentation and the bigger lesson for perimeter kit
Patching closes the hole, but firms should also check logs against the three published malicious IPs and review management-interface authentication events for anomalies going back several weeks, since Palo Alto hasn't yet confirmed when exploitation began. This is exactly the kind of gap that benefits from continuous monitoring rather than periodic log reviews — a case for managed detection and response where in-house SOC capacity is thin.
This also arrives in a year where firewalls, VPN gateways and load balancers have repeatedly been the entry point for ransomware crews, alongside similar RCE disclosures from other edge-device vendors. Any organisation still planning infrastructure refreshes, including those weighing VMware alternatives post-Broadcom, should fold firewall and management-plane exposure into that same risk conversation rather than treating it separately.
What UK buyers should do this week
Confirm every PAN-OS device — firewalls and Panorama alike — is on a patched build, prioritising anything with an internet-facing or broadly-accessible management interface. Where patching can't happen immediately, lock the management interface down to a short allow-list of trusted internal IPs as an interim control, and enable available Threat Prevention signatures while accepting their limits.
Budget holders should also use this as leverage to fund the segmentation and credential-hygiene work that's been sitting in a backlog. If you need a structured view of where that spend should go, our IT finance calculator can help frame the business case, and our team is on hand via talk to a Servnet engineer for urgent patch validation.