Swiss SME Cyber Alert: Palo Alto PAN-OS – actively exploited admin flaw enables root access
Palo Alto Networks has confirmed attacks targeting CVE-2026-0322 in the PAN-OS management interface. An attacker must already have authenticated administrator access and network access to management; they can then execute code with root privileges on the firewall.
If your organisation uses Palo Alto firewalls or Panorama, ask your IT provider today to check the version, management exposure and possible signs of misuse, and to install a fixed release.
What happened?
Palo Alto Networks published the advisory on 14 October 2026 and rates CVE-2026-0322 at CVSS 8.6 with its highest suggested urgency. The vendor has observed very limited exploitation targeting the PAN-OS management interface. CISA added the vulnerability to its KEV catalogue on the same day.
Could my company be affected?
The issue affects PAN-OS on PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access are not affected. Exploitation requires an authenticated account with high privileges and network access to the management interface; externally reachable management is at greatest risk.
What should you do now?
Ask your IT provider to take these steps now:
Compare PAN-OS versions on every firewall and Panorama system with the vendor’s live table and install a fixed release.
Check whether the management interface is reachable from external or untrusted networks, and restrict it to internal administration systems or a jump box.
Review administrator accounts, authentication logs and system events for anomalies; start a compromise assessment if there are signs of misuse.
How urgent is it?
High – verify today. The vulnerability is already being exploited and can provide root access to a central security device. It is not an unauthenticated attack, however: the attacker needs privileged, authenticated management access.
Information for your IT provider
Affected branches include PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 in the older builds listed in the advisory. Fixed targets include, depending on the maintenance branch, 10.2.18-h12, 11.1.16-h3, 11.2.13-h3, 12.1.10-h2 and 12.2.4 or a later fixed release. There is no complete workaround. Threat IDs 510046 and 510047 provide limited coverage only and require additional configuration, including SSL decryption.
