Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks patches PAN-OS RCE flaw CVE-2026-0322 amid active exploitation.
Run Palo Alto Networks?
Get an email when a reviewed story names Palo Alto Networks, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Palo Alto Networks has released security updates for a critical remote code execution (RCE) vulnerability in its PAN-OS software, tracked as CVE-2026-0322. The flaw, which affects the management interface and carries a CVSS score of 8.6, is reportedly being actively exploited in the wild. The company urges customers to update their systems immediately to mitigate the risk of compromise.
The lesson from this incident
Full lessonA critical authenticated remote code execution vulnerability (CVE-2026-0322, CVSS 8.6) in Palo Alto Networks' PAN-OS was actively exploited before a patch was widely applied, targeting the management interface of a widely deployed security platform. This incident highlights the dangerous irony of security appliances themselves becoming attack vectors, amplifying risk across every network they protect. Active exploitation means organizations that delay patching are not just vulnerable — they may already be compromised. The management interface exposure underscores that even authenticated entry points require strict access controls and rapid patch cycles. Treating network security appliances as exempt from rigorous vulnerability management is a critical and costly misconception.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
- cve — CVE-2026-0322