Palo Alto Networks released security updates on Wednesday for a high-severity PAN-OS vulnerability that is already being exploited in the wild. Tracked as CVE-2026-0322 with a CVSS score of 8.6, the flaw is a remote code execution bug in the management interface.

According to Palo Alto Networks, an authenticated attacker with network access could exploit it to run arbitrary code with root privileges on the firewall. No special configuration is needed to exploit the issue. The company advises restricting management interface access to trusted internal IP addresses, or limiting it to a jump box as the sole system permitted to reach the interface.

PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) are affected. Cloud NGFW and Prisma Access are not. Palo Alto Networks said it has observed "very limited exploitation" targeting the management interface but did not detail the activity, its origin, or its timing. Three U.S.-geolocated IP addresses are assessed as linked to the exploit attempts: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234.

Fixes are available in PAN-OS 12.2.4 and later, plus listed maintenance releases across the 12.1, 11.2, 11.1 and 10.2 branches, with one 11.2.16 release slated for October 15, 2026. The company credited Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, with discovering and reporting the flaw.

The disclosure coincided with a Cisco warning that attackers are exploiting a critical Cisco Secure Email Gateway flaw, CVE-2026-76519 (CVSS 9.8), which stems from improper handling of email attachments when the file reputation service is enabled and could let an unauthenticated remote attacker write arbitrary files and execute commands with root privileges. CISA has added both CVEs to its Known Exploited Vulnerabilities catalog, requiring Federal Civilian Executive Branch agencies to prioritize fixes by October 17, 2026.

Source: The Hackers News