Palo Alto PAN-OS Zero-Day Added to KEV, Fix by Oct 17

Palo Alto Networks has patched CVE-2026-0322, a high-severity code injection flaw in PAN-OS now confirmed exploited in attacks targeting firewalls. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on October 14 with a federal remediation deadline of October 17. Three days.

CISA reserves that kind of timeline for vulnerabilities that are already being used against real targets, not ones that might be someday.

What the flaw does

CVE-2026-0322 is a code injection bug in PAN-OS. An authenticated attacker with network access to the firewall can exploit it to execute arbitrary code with root privileges on the device. The authentication requirement limits the exposure compared to an unauthenticated bug, but it doesn’t make this theoretical: credentials for network perimeter devices are a commodity in underground markets, and firewalls are specifically worth targeting because of the position they hold.

Root-level code execution on a perimeter firewall gives an attacker the ability to inspect, modify, or redirect traffic at your network’s edge. That’s a hard position to detect and a harder one to evict.

Patches and required action

Palo Alto Networks confirmed active exploitation in its security advisory and released patches. The CISA KEV entry directs organizations to apply vendor mitigations per Binding Operational Directive 26-04. The October 17 deadline formally applies to federal civilian agencies, but treating it as a universal target is reasonable given the confirmed exploitation.

Palo Alto’s patch guidance and affected version details are available through the Palo Alto Networks security advisory portal.

If an immediate patch isn’t possible: restrict management interface access to known-good IP ranges, audit recent authentication logs for anomalous activity, and monitor for unexpected outbound connections from PAN-OS devices.

Context: a busy week for perimeter devices

CVE-2026-0322 is the third confirmed-exploited network perimeter vulnerability added to CISA KEV in the same week. Cisco’s Secure Email Gateway took its second zero-day in recent weeks, and CISA issued an urgent fix notice for Ivanti Connect Secure CVE-2026-104935 on October 14 as well.

Whether that cluster reflects coordinated threat actor activity or the usual overlap of disclosure cycles is an open question. Qilin ransomware operators have previously exploited PAN-OS GlobalProtect flaws in targeted intrusions, which gives some indication of who pays attention to Palo Alto advisories.

The operational lesson is consistent regardless of the reason: network device patching has less margin for delay than endpoint patching. These devices sit at boundaries, they’re trusted by design, and once one is compromised, the usual detection layers often don’t see what happens next.