[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpiLkrWIdb2opVMuGY7DJxdC7U55alkm5oYUYWRS4T1Q":3},{"article":4,"iocs":54,"watch_terms":63,"solutions":64,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"60b0e23f-c064-437d-8006-7053ffe7fe3c","Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution","palo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution-bc4412","The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available. The post Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution appeared first on SecurityWeek.","Palo Alto Networks has released patches for a critical PAN-OS zero-day vulnerability, CVE-2026-0322, which allows authenticated attackers to achieve remote code execution with root privileges on firewalls. The company is aware of limited exploitation against its customers and has provided IoCs, including specific IP addresses. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to address it by October 17.","Palo Alto Networks patches PAN-OS zero-day exploited for remote code execution.","https:\u002F\u002Fwww.securityweek.com\u002Fpalo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F11\u002FPalo-Alto-Networks-zero-day.jpeg","2026-10-15T06:59:54+00:00","2026-10-15T08:00:08.799392+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"PAN-OS","product",{"name":21,"type":22},"Palo Alto Networks","vendor",{"name":24,"type":19},"PA-Series",{"name":26,"type":19},"VM-Series",{"name":28,"type":19},"Panorama",{"name":30,"type":19},"Prisma Cloud","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59],{"type":56,"value":57,"context":58},"cve","CVE-2026-0322","PAN-OS zero-day vulnerability allowing RCE",{"type":60,"value":61,"context":62},"ip","192.168.1.1","Example IP address associated with observed exploitation activity",[21,18,24],{"controls":65,"vendors":152},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":96,"name":97,"problem":98,"products":99},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":125,"name":126,"problem":127,"products":128},"patch-management","Automated patch management","Known holes get closed in days, not months.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":125,"product_name":149,"url":150,"description":151},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[153],{"slug":154,"name":21,"logo_path":155,"roles":156},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[157,158],"affected","reported_by",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":174},"pan-os-zero-day-enables-root-level-rce-on-firewalls","PAN-OS Zero-Day Enables Root-Level RCE on Firewalls","A critical zero-day vulnerability (CVE-2026-0322) in Palo Alto Networks' PAN-OS allowed authenticated attackers to execute arbitrary code with root privileges on firewall appliances — the very devices meant to protect network perimeters. The fact that active exploitation was observed before a patch was widely applied underscores the danger of delayed remediation on internet-facing security infrastructure. CISA's inclusion in the Known Exploited Vulnerabilities catalog signals this is not a theoretical risk but an active threat requiring urgent action. Organizations that treat security appliances as 'set and forget' devices are especially vulnerable, as these systems require the same rigorous patch discipline as any other critical asset.",[164,165,166,167,168,169,170,171,172,173],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 5: Account Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST CM-6: Configuration Settings","NIST AC-17: Remote Access","CISA KEV Catalog","ITIL Change Management: Emergency Change Procedures","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]