Affected Systems
PAN-OS on PA-Series, VM-Series firewalls, and Panorama (virtual and M-Series). All versions prior to patched releases: 10.2.x, 11.1.x, 11.2.x, 12.1.x, 12.2.x. Cloud NGFW and Prisma Access are not affected. Exploitation requires authenticated access to the management interface.
Exploitation Status
Active exploitation confirmed by Palo Alto Networks. Very limited targeting observed against management interfaces. CISA added CVE-2026-0322 to KEV catalog. Three U.S.-based IP addresses linked to exploit attempts: 66.42.72.14, 208.83.239.114, 149.248.47.234.
Business Impact
Authenticated attackers with network access to PAN-OS management interface can execute arbitrary code with root privileges. No special configuration required for exploitation. Federal agencies must patch by October 17, 2026 per CISA directive. Risk is elevated for organizations with management interfaces exposed to untrusted networks or with weak authentication controls.
Urgency
🔴 Immediate
Recommended Actions
- Apply PAN-OS patches immediately: 12.2.4+, 12.1.4-h12+, 11.2.4-h22+, 11.1.4-h37+, or 10.2.7-h38+ depending on your branch
- Restrict management interface access to trusted internal IP addresses only; implement jump box architecture if not already in place
- Review authentication logs for management interface access from suspicious IPs, especially 66.42.72.14, 208.83.239.114, and 149.248.47.234
- Audit all accounts with management interface access; disable unused accounts and enforce MFA for all administrative users
- Monitor firewall logs for unusual root-level command execution or file system changes post-authentication