[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f95QNL_dfOk9771sBRrcWMu02fcSjxHyWASnt_H-Cp-U":3},{"article":4,"iocs":54,"watch_terms":67,"solutions":68,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"46225c87-6c28-4ca5-af8d-7bdc7868da24","Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks","palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks-10dada","Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]","Palo Alto Networks has issued a warning about a critical zero-day vulnerability (CVE-2026-0322) in its PAN-OS software that has been actively exploited in limited attacks. The flaw affects the management interface of PA-Series and VM-Series firewalls, as well as Panorama appliances, allowing authenticated attackers with network access to execute code as root. While fixes are available for several versions, CISA has added it to its Known Exploited Vulnerabilities catalog, mandating mitigation for federal agencies.","Palo Alto Networks warns of PAN-OS RCE zero-day (CVE-2026-0322) exploited in attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fpalo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F10\u002F09\u002FPalo-Alto-Networks.jpg","2026-10-14T22:56:47+00:00","2026-10-15T00:00:08.52533+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"PAN-OS","product",{"name":21,"type":22},"Palo Alto Networks","vendor",{"name":24,"type":19},"PA-Series firewalls",{"name":26,"type":19},"VM-Series firewalls",{"name":28,"type":19},"Panorama",{"name":30,"type":19},"Cloud NGFW","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,63,65],{"type":56,"value":57,"context":58},"cve","CVE-2026-0322","PAN-OS RCE zero-day vulnerability",{"type":60,"value":61,"context":62},"ip","66.42.72.14","IP address exploiting CVE-2026-0322",{"type":60,"value":64,"context":62},"208.83.239.114",{"type":60,"value":66,"context":62},"149.248.47.234",[21,18,24],{"controls":69,"vendors":157},[70,99,128],{"slug":71,"name":72,"problem":73,"products":74},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":100,"name":101,"problem":102,"products":103},"patch-management","Automated patch management","Known holes get closed in days, not months.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":129,"name":130,"problem":131,"products":132},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[133,141,149],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","secure-firewall","Cisco Secure Firewall","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Ffirewalls\u002Findex.html","Next-generation firewalls with intrusion prevention, using Talos threat intelligence.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-firewall","Sophos Firewall","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fnext-gen-firewall","Next-generation firewall with intrusion prevention.",[158],{"slug":159,"name":21,"logo_path":160,"roles":161},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[162,163],"affected","reported_by",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":180},"pan-os-zero-day-rce-exploited-in-the-wild-patch-immediately","PAN-OS Zero-Day RCE Exploited in the Wild — Patch Immediately","A critical zero-day vulnerability (CVE-2026-0322) in Palo Alto Networks PAN-OS allowed authenticated attackers with network access to the management interface to execute arbitrary code as root, effectively compromising the firewall itself. The fact that this flaw resides in the management interface highlights a common misconfiguration risk: exposing administrative surfaces to broad or untrusted networks. Active exploitation before a patch was widely applied underscores the danger of delayed remediation cycles for network security appliances. CISA's addition to the Known Exploited Vulnerabilities catalog signals that threat actors are actively weaponizing this flaw, raising the stakes for any organization running affected versions. When a firewall is compromised, all traffic flowing through it — and the trust model it enforces — must be considered suspect.",[169,170,171,172,173,174,175,176,177,178,179],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 4: Secure Configuration of Enterprise Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SP 800-41: Guidelines on Firewalls and Firewall Policy","NIST CSF RS.MI-3: Vulnerability mitigations are applied","NIST AC-17: Remote Access","NIST SI-2: Flaw Remediation","CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities","ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities","ITIL 4: Change Enablement \u002F Emergency Change Process",{}]