Palo Alto Networks released fixes on October 14 for CVE-2026-0322, a PAN-OS remote code execution vulnerability under active attack. The vendor reported very limited exploitation targeting its management interface and urged affected customers to remediate promptly.

The CVE record identifies PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances as affected. Cloud NGFW and Prisma Access are excluded. BleepingComputer reported the disclosure on October 14; the company has not publicly identified the attackers in its advisory.

According to the vendor, exploitation requires an authenticated attacker with network access to the management interface and can yield root-level code execution. The advisory rates the flaw at CVSS 4.0 severity 8.6.

The advisory lists fixes across PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2. Administrators should consult its branch-specific upgrade table. PAN-OS 11.2.16 was still listed with an October 15 release estimate. Unsupported releases require migration to a supported fixed version.

Palo Alto Networks says no workaround is known. Its Threat Prevention signatures provide only limited coverage and require management-traffic inspection with SSL decryption.

The company recommends limiting management access to trusted internal IP addresses. Its guidance prioritizes upgrading affected systems to an unaffected version, particularly where management interfaces are accessible from the internet.