What Happened

Palo Alto Networks disclosed CVE-2026-0322, a remote code execution vulnerability in the PAN-OS management interface, on October 14, 2026. The flaw carries a CVSS score of 8.6 and allows authenticated attackers with network access to execute arbitrary code as root. CISA has added the CVE to its Known Exploited Vulnerabilities catalog because of active in-the-wild exploitation.

Who Is Affected

Affected systems include PA-Series and VM-Series firewalls and Panorama appliances running vulnerable PAN-OS versions. Cloud NGFW and Prisma Access are not impacted. Palo Alto Networks has released fixes for several PAN-OS versions, with additional updates expected.

• PA-Series and VM-Series firewalls
• Panorama management appliances

Market Impact

For sellers into enterprise security operations, this is an urgent trigger: active exploitation plus CISA KEV designation means impacted customers need rapid patching, evidence of remediation, and tighter management interface controls.

• Patch management and vulnerability scanning tools are immediately relevant.
• Incident response teams should investigate limited exploitation attempts noted in the advisory.
• Firewall management hygiene — especially restricting management interface access — becomes a selling point.

What to Watch

Expect follow-up patches as Palo Alto Networks expands fixed PAN-OS versions. Track whether exploitation escalates beyond limited attempts, and monitor CISA KEV updates for related CVEs such as CVE-2026-0314.

Related coverage

• Nomios Acquires Portuguese Cybersecurity Firm Orbcom for Iberian Expansion
• Palo Alto Networks founder Nir Zuk raises $245M for new cybersecurity startup Cylake
• Palo Alto Networks Q4 FY2026: RPO Crosses $21.2B, NGS ARR Reaches $9.1B
• Palo Alto Networks Acquires AI Agent Platform Console