Palo Alto Firewall Flaw Gives Attackers Root Control: Federal Agencies Have Three Days to Fix It

Key points

• CVE-2026-0322, disclosed October 14 2026, lets a logged-in attacker run any command as the firewall's most powerful user, root, on Palo Alto Networks PAN-OS software.
• CISA, the US federal cybersecurity agency, added the flaw to its list of vulnerabilities actively exploited in the wild on the same day Palo Alto published its advisory.
• US federal agencies face a binding deadline of October 17 2026 to apply fixes or disconnect affected devices.
• Palo Alto Networks confirmed "very limited exploitation" has already occurred targeting the management interface, the administrative control panel of the firewall.
• Cloud NGFW and Prisma Access are not affected; PA-Series and VM-Series firewalls plus Panorama management platforms are.

A firewall is the digital equivalent of a security guard stationed between a company's internal network and the outside world. Palo Alto Networks makes some of the most widely deployed firewalls on the planet. So when a flaw surfaces that lets an attacker seize complete control of one, the alarm bells ring loudly and fast.

That is exactly what happened on October 14 2026, when Palo Alto Networks published an advisory for CVE-2026-0322, a code injection vulnerability, meaning a flaw that lets an outsider slip their own instructions into software that then executes them, inside PAN-OS, the operating system that runs the company's firewalls.

What does this flaw actually do?

It hands an attacker the keys to the building. A criminal who can reach the firewall's management interface, and who has any valid login, can run arbitrary code, meaning any command they choose, as root, the most privileged account on the system. From there, they control a device that decides what traffic the entire network allows or blocks.

The advisory is direct: "No special configuration is required to be affected by this issue." A CVSS score of 8.6 out of 10 places it firmly in the high-severity bracket.

Palo Alto says the flaw was discovered internally, and reports that exploitation so far has been "very limited." That word "so far" is doing heavy lifting. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalogue the same day, confirming real attacks are already happening.

Who is at risk and what should they do?

Any organisation running PAN-OS on PA-Series or VM-Series firewalls, or on the Panorama management platform, is in scope. Patch immediately.

Fixed versions exist for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2. Customers still on 11.2.14 or 11.2.15 were pointed toward 11.2.16, with an estimated release date of October 15. Anyone on an unsupported version needs to move to a supported fixed release, not just apply a hotfix.

While waiting for a patch, Palo Alto strongly recommends restricting the management interface to trusted internal IP addresses only. The advisory also notes that customers with a Threat Prevention subscription can enable Threat IDs 510046 and 510047 (from content version 9159-10287 or later) for limited protection, though SSL decryption must be active for those signatures to work, and the advisory acknowledges that "variations may exist that cannot currently be detected."

No other workaround exists.

Should customers who aren't federal agencies worry?

Yes. The three-day federal deadline reflects how seriously CISA views active exploitation, not a privilege reserved for government networks.

The advisory's own guidance makes clear the highest risk comes from management interfaces reachable from the public internet. Credentials stolen through phishing (fake emails designed to trick staff into handing over passwords) or reused from other breached services are the most likely way an attacker would get the valid login the flaw requires. Once inside, they can quietly reconfigure the firewall to stay compromised even after a casual review.

Patching closes the door. But anyone who runs an affected device should also check admin login history for unusual activity and review firewall configurations for unexpected changes before and after applying fixes. If a device was reachable from outside a trusted network before the patch landed, treat it as potentially already touched.

The plain truth here, as CSO Online also noted in its coverage, is that management interfaces keep surfacing as the weak point precisely because they're left exposed by default in too many deployments. This flaw makes that habit very expensive.