Palo Alto Networks on Wednesday informed customers that it has released patches for a PAN-OS zero-day vulnerability exploited in malicious attacks.
The high-severity flaw is tracked as CVE-2026-0322 and it allows remote code execution. It affects the management interface of PAN-OS and it can be exploited by an authenticated attacker with network access to execute arbitrary code with root privileges on the targeted firewall.
“Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” Palo Alto Networks noted in its advisory.
The zero-day was discovered internally. It affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama. The security firm noted that no special configuration is needed to exploit CVE-2026-0322.
The cybersecurity giant has released indicators of compromise (IoCs) associated with the observed activity, specifically a few IP addresses.
No information has been shared on the attacks exploiting this new zero-day or the threat actor responsible.