Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls

What happened?

Hackers are exploiting a high-severity flaw in Palo Alto Networks PAN-OS that allows authenticated attackers to run code with root privileges on affected firewalls. Tracked as CVE-2026-0322, the vulnerability affects the management interface, with the company confirming “very limited exploitation” and urging customers to apply fixes as soon as possible. Palo Alto Networks published its security advisory on October 14, 2026, assigning the flaw a CVSS 4.0 score of 8.6 and its highest remediation urgency.

Key details

• Attackers are exploiting a high-severity PAN-OS flaw to run code as root on firewalls.
• The vulnerability is a code injection weakness requiring authenticated high-privilege access to the management interface.
• Palo Alto Networks confirmed very limited exploitation and assigned the flaw a CVSS 4.0 score of 8.6.
• Affected products include PA-Series, VM-Series, and Panorama on virtual systems or M-Series appliances.
• Cloud NGFW and Prisma Access are not affected and require no action for this vulnerability.
• No known workaround exists; restricting management access to trusted IPs reduces exposure but does not replace patching.
• Palo Alto identified three IP addresses linked to threat activity and limited exploit attempts.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.