{"id":10016,"date":"2026-10-15T11:59:40","date_gmt":"2026-10-15T11:59:40","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10016"},"modified":"2026-10-15T11:59:40","modified_gmt":"2026-10-15T11:59:40","slug":"attackers-exploit-palo-alto-pan-os-flaw-for-root-access-as-cisa-orders-three-day-fix","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10016","title":{"rendered":"Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Attackers are exploiting a newly disclosed flaw in Palo Alto Networks\u2019 PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for compromise by October 17.<\/p>\n

Palo Alto Networks disclosed the vulnerability, tracked as CVE-2026-0322, in a security advisory published October 14. The flaw \u201cenables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall,\u201d the advisory<\/a> said.<\/p>\n

\u201cVery limited exploitation has been observed targeting the Palo Alto Networks management interface,\u201d the company said. It rated the flaw 8.6 on the CVSS 4.0 scale, which is high severity, and assigned it its highest urgency rating. The company classified it as CWE-94<\/a>, a code injection weakness.<\/p>\n

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog the same day, citing evidence of active exploitation.<\/p>\n

Forensic triage required<\/h2>\n

The catalog entry marks the flaw as requiring forensic triage under Binding Operational Directive 26-04. The directive \u201cestablishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied,\u201d CISA said<\/a> in its alert announcing the addition.<\/p>\n

The entry directs agencies to apply the vendor\u2019s mitigations or discontinue use of the product if mitigations are unavailable. It lists the flaw\u2019s use in ransomware campaigns as unknown.<\/p>\n

Yih Khai Wong, senior research manager for security services at IDC Asia\/Pacific, said security teams should trace who can reach the management interface from outside a trusted network and review admin login history for unusual activity. \u201cThey should also check firewall configurations for unexpected changes, since a compromised device can be quietly reconfigured to remain compromised,\u201d he said.<\/p>\n

\u201cPatching is only part of the response,\u201d said Vibhum Dubey, a cybersecurity researcher and red teamer. He said teams should check Panorama and every managed firewall and preserve evidence before making changes.<\/p>\n

Affected products and fixes<\/h2>\n

The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama, in both virtual and M-Series form, according to the advisory. Cloud NGFW and Prisma Access are not affected.<\/p>\n

\u201cNo special configuration is required to be affected by this issue,\u201d the advisory said.<\/p>\n

Palo Alto Networks has released fixed versions for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with hotfix releases listed for each maintenance line. The advisory gave an estimated release date of Oct. 15 for PAN-OS 11.2.16, the upgrade path for customers on 11.2.14 and 11.2.15. Customers on unsupported versions should move to a supported fixed release, the company advisory said.<\/p>\n

Wong said management access to any device still awaiting a fix should be locked down, or compensating controls should be applied on the device.<\/p>\n

How attackers get in<\/h2>\n

The advisory does not say how attackers obtained that access, when exploitation began, or how many customers were affected.<\/p>\n

\u201cThe entry point probably isn\u2019t the bug itself, but weak management-access hygiene,\u201d Wong said. He cited admin credentials stolen through phishing or reuse, management interfaces left reachable from the internet, or an earlier compromise that gave an attacker valid logins.<\/p>\n

\u201cOnce they can execute code as root on a firewall, they have control over a device that enforces security across the network,\u201d Dubey said.<\/p>\n

Palo Alto Networks said the flaw was discovered internally.<\/p>\n

No workarounds yet<\/h2>\n

\u201cNo known workarounds exist for this issue,\u201d the advisory said.<\/p>\n

Customers with a Threat Prevention subscription can enable Threat IDs 510046 and 510047, which the company said provide limited coverage and require SSL decryption. \u201cVariations may exist that cannot currently be detected,\u201d the advisory\u2019s FAQ said.<\/p>\n

The company said risk \u201cis highest when you allow access to the management interface from external IP addresses on the internet\u201d and recommended restricting access to trusted internal IP addresses.<\/p>\n

Wong said the narrow gap is a warning because a jump box only limits or slows access and does not reduce the damage from an intruder holding valid credentials. \u201cThe real risks are credential security and detecting misuse after login, not simply restricting the front door,\u201d he said.<\/p>\n

Wong said enterprises should ask vendors why management interfaces keep emerging as the weak point instead of being locked down by default, how they detect misuse of valid admin credentials, and how quickly patches reach every supported version. \u201cUntil every affected release is covered, production systems remain exposed,\u201d he said.<\/p>\n

\u201cIf an attacker gains control of a firewall, organizations need a clear way to determine whether the device can still be trusted,\u201d Dubey said. Palo Alto Networks did not immediately respond to a request for comment.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Attackers are exploiting a newly disclosed flaw in Palo Alto Networks\u2019 PAN-OS firewall software to run code with root privileges, and US federal agencies have been ordered to fix it and check for compromise by October 17. Palo Alto Networks disclosed the vulnerability, tracked as CVE-2026-0322, in a security advisory published October 14. The flaw […]<\/p>\n","protected":false},"author":0,"featured_media":10017,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10016","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10016"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10016"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10016\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10017"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}