Palo Alto Networks has shipped patches for a high-severity remote code execution flaw in PAN-OS, tracked as CVE-2026-0322, after confirming limited exploitation in the wild. The company disclosed the vulnerability in a security advisory published Wednesday, warning that attackers with existing credentials and network access to the PAN-OS management interface can execute code as root on affected devices.

The flaw carries a severity score of 8.6 and affects PA-Series and VM-Series firewalls, along with Panorama virtual and M-Series appliances. Palo Alto Networks says Cloud NGFW and Prisma Access are not impacted. Because exploitation requires authenticated access, the vendor is urging customers to restrict management interface access to trusted internal IP addresses as a baseline defense.

Fixes are available for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with a patch for PAN-OS 11.2.16 expected to land October 15. There is no workaround for the vulnerability. Customers with Threat Prevention subscriptions can enable signatures that detect known attack patterns, but Palo Alto Networks cautions this coverage is limited and may not catch variants of the exploit. Organizations running unsupported PAN-OS versions are advised to upgrade to a patched release rather than rely on signatures alone.

The flaw was found internally by Suraj Siddharudh, a senior principal product security researcher at the company. Palo Alto Networks also published three IP addresses observed exploiting the vulnerability: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234, which defenders can use for blocking and hunting.

CISA Action and Related KEV Additions

CISA has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to mitigate it by October 17 under Binding Operational Directive 26-04. In the same update, CISA added three other actively exploited flaws: a Cisco Secure Email Gateway relative path traversal bug (CVE-2026-76519), an Ahsay AhsayCBS improper authentication vulnerability (CVE-2026-105133), and an Ahsay AhsayCBS command injection flaw (CVE-2026-105134).

BOD 26-04 directs agencies to prioritize remediation of KEV entries that grant full post-exploitation control of an asset and to check whether systems were compromised before patches were applied. While the directive applies only to federal agencies, CISA is encouraging all organizations to treat these four vulnerabilities as urgent patching priorities.