Vulnerability in firewall software disclosed

Palo Alto Networks has released patches for a critical vulnerability in PAN-OS, a firewall operating system, that allows an attacker with privileged access to execute code with the highest privileges on affected devices. The vulnerability, identified as CVE-2026-0322, was made public on Wednesday, October 14, though exploitation attempts had already been observed.

Attackers linked to specific IP addresses

Palo Alto Networks has identified three IP addresses associated with attack attempts: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. However, the company has not specified the identity of the attackers or whether these attempts resulted in compromised devices.

Vulnerability affects management interface

The vulnerability affects the management interface of PAN-OS, used by administrators to configure firewalls and monitor their operation. It allows injecting code into the system and executing it with root privileges, the highest level of authorization. A hacker could thus directly intervene on the device's operating system, beyond the functions normally accessible through its administration interface.

Exploitation requires specific conditions

However, exploitation requires two conditions: the attacker must already have authenticated access with high privileges and be able to communicate with the management interface over the network. The vulnerability therefore does not allow taking control of a firewall without credentials, unlike other vulnerabilities discovered this year. It nevertheless represents a significant risk when a privileged account has been compromised, particularly if the administration interface is accessible from an unreliable network.

Severity and affected versions

Palo Alto Networks assigns a severity score of 8.6 out of 10 to CVE-2026-0322 and confirms having observed very limited exploitation. The vulnerability affects several generations of PAN-OS, versions 10.2 to 12.2, on physical firewalls PA-Series, virtual models VM-Series, and Panorama appliances used for centralized administration. The Cloud NGFW and Prisma Access services are not affected.

Patches and mitigation strategies

For affected businesses, priority is given to updates. Palo Alto Networks has published patches for the various vulnerable versions. The one intended for PAN-OS 11.2.16 is announced for this Thursday, October 15. The publisher also recommends restricting access to the administration interfaces to internal trusted IP addresses or a dedicated server to prevent connections from unauthorized networks.

Detection and response measures

Companies subscribed to Threat Prevention also have two detection signatures, referenced 510046 and 510047. However, their effectiveness depends on the configuration of encrypted traffic inspection, and their coverage is limited to attack methods already identified. They therefore do not replace patches.

Post-attack investigation steps

Finally, if you suspect an intrusion, examine the login logs and any potential configuration changes on your devices. Also check if any of the three IP addresses reported by Palo Alto Networks appear in the logs. In the case of confirmed compromise, the installation of the patch does not guarantee the elimination of any potential malicious presence. You will then need to preserve elements useful for the investigation before considering, based on the analysis results, a thorough reset of physical devices or the redeployment of virtual instances.