Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix

Source: CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4235787/attackers-exploit-palo-alto-pan-os-flaw-for-root-access-as-cisa-orders-three-day-fix.html

ONE SENTENCE SUMMARY:

CVE-2026-0322 enables authenticated root code execution on PAN-OS management interfaces, prompting urgent patching and forensic compromise checks.

MAIN POINTS:

1. Palo Alto disclosed CVE-2026-0322 on October 14 with high urgency and 8.6 severity.
2. Vulnerability allows authenticated network-access attackers to execute arbitrary code as root.
3. Limited exploitation observed targeting the Palo Alto management interface.
4. CISA added it to Known Exploited Vulnerabilities, ordering federal remediation by October 17.
5. Binding Operational Directive 26-04 requires forensic triage to detect pre-patch compromise.
6. Affected include PA-Series, VM-Series, and Panorama (virtual and M-Series) running PAN-OS.
7. Cloud NGFW and Prisma Access are explicitly not impacted.
8. Fixed releases issued for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 maintenance lines.
9. No workaround exists; Threat Prevention IDs 510046/510047 offer limited, SSL-decryption-dependent detection.
10. Likely initial access stems from poor management-access hygiene and stolen or reused admin credentials.

TAKEAWAYS:

1. Patch quickly across all supported PAN-OS versions and migrate off unsupported releases immediately.
2. Perform forensic review of Panorama and managed firewalls before changes, preserving evidence.
3. Restrict management interface exposure to trusted internal IPs and minimize external reachability.
4. Audit admin logins and configuration changes for persistence tactics or unauthorized reconfiguration.
5. Treat credential protection and post-login anomaly detection as primary controls, not just jump boxes.