securityweek.comarticlePalo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Palo Alto Networks patched CVE-2026-0322, a high-severity zero-day in the PAN-OS management interface that lets an authenticated attacker with network access run arbitrary code as root. It affects PA-Series, VM-Series and Panorama with no special configuration needed, and "very limited" exploitation has been seen. The vendor published a few IP-based IoCs, CISA added the flaw to KEV with an October 17 deadline, and a dozen other medium/low advisories were released the same day.
TL;DR Palo Alto patches exploited PAN-OS management-interface RCE zero-day CVE-2026-0322; added to CISA KEV, IoCs released.
Organisations named here
- CISA
CVEs named here
- CVE-2026-0322
Technologies named here
- GlobalProtect
- PAN-OS
- Panorama
- CISA Known Exploited Vulnerabilities Catalog
- Palo Alto Networks security advisory
- Palo Alto Networks GlobalProtect
- Palo Alto Networks Prisma Cloud
- Palo Alto Networks Prisma Browser
- CISA KEV
- Palo Alto Networks
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup