Affected Systems
PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2 on PA-Series and VM-Series firewalls, Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access not affected. Requires authenticated access to management interface.
Exploitation Status
Active exploitation confirmed by Palo Alto Networks. Limited attacks observed targeting management interface. Three attacker IPs disclosed: 66.42.72.14, 208.83.239.114, 149.248.47.234. Added to CISA KEV catalog.
Business Impact
Authenticated attackers with network access to PAN-OS management interface can execute arbitrary code as root. CVSS 8.6. Exploitation requires existing credentials and network access, reducing attack surface if management interfaces are properly segmented. No workarounds available. Threat Prevention signatures provide only limited protection against known patterns; variants may evade detection.
Urgency
🔴 Immediate
Recommended Actions
- Apply PAN-OS security updates immediately for versions 10.2, 11.1, 11.2, 12.1, and 12.2 (11.2.16 fix available October 15)
- Restrict PAN-OS management interface access to trusted internal IP addresses only; remove any internet-facing exposure
- Block attacker IPs 66.42.72.14, 208.83.239.114, and 149.248.47.234 at perimeter and review logs for connections from these sources
- Enable Threat Prevention signatures for CVE-2026-0322 if subscription is active, understanding coverage is limited to known attack patterns
- Audit firewall access logs for unauthorized authentication attempts or suspicious administrative activity since early October 2026