Loading story…
Palo Alto Networks released patches for CVE-2026-0322, a high-severity PAN-OS zero-day exploited in very limited attacks against customer management interfaces. The vulnerability requires an authenticated, highly privileged attacker with network access and allows arbitrary code execution as root. Rated 8.6 under CVSS 4.0, it affects PA-Series firewalls, VM-Series firewalls, and Panorama deployments; Cloud NGFW and Prisma Access are not affected. Palo Alto Networks discovered the flaw internally but has not disclosed the responsible threat actor or further attack details.
Palo Alto Networks assigned the flaw its highest remediation urgency and provided fixed releases across multiple PAN-OS branches. No known workaround exists: restricting management-interface access reduces exposure but does not replace patching. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and directed federal agencies to remediate it by October 17, 2026. Defenders should prioritize affected deployments and review the vendor’s three published threat-associated IP addresses, while accounting for its warning that attack variations may evade current detection signatures. The vendor also issued a dozen other advisories addressing medium- and low-severity flaws in PAN-OS, GlobalProtect, and Prisma Cloud.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks published a dozen additional advisories covering medium- and low-severity vulnerabilities fixed in PAN-OS, GlobalProtect, and Prisma Cloud. The flaws included denial-of-service, command injection, identity hijacking, local privilege escalation, cross-site scripting, and path traversal issues.
CISA added the PAN-OS vulnerability to its Known Exploited Vulnerabilities catalog and directed federal agencies to address it by October 17, 2026.
Palo Alto Networks published an advisory and announced patches for the high-severity vulnerability affecting PA-Series firewalls, VM-Series firewalls, and Panorama, assigning its highest remediation urgency. The company credited internal researcher Suraj Siddharudh with discovering and reporting the flaw; Cloud NGFW and Prisma Access were unaffected.
Palo Alto Networks published 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234 as indicators associated with threat activity and limited exploit attempts. The company warned that attack variations could evade current detection signatures.
Palo Alto Networks observed very limited exploitation of CVE-2026-0322 targeting customers’ management interfaces. Exploitation required an authenticated, highly privileged account and network access, allowing attackers to execute code as root.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
socprime.com
Open sourcecert.ug
Open sourceheise.de
Open sourceacn.gov.it
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourcecert.pa
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **CVE-2026-0310**, a high-severity XML-processing buffer overflow in PAN-OS that can allow an unauthenticated remote attacker to execute arbitrary code as `root` on affected PA-Series hardware firewalls. The flaw, scored 9.2 CVSS-B, is reachable through vulnerable management-web or dataplane interfaces using specially crafted XML; exploitation is considered high complexity. On VM-Series appliances, the impact is limited to denial of service, while Prisma Access and Cloud NGFW deployments face more restricted exposure because exploitation requires authentication and their external interfaces are less accessible. Palo Alto Networks released fixed PAN-OS versions and states that no workaround is available; administrators should immediately apply the vendor updates and restrict management access to trusted networks. Canadian and Italian government advisories also identify affected PAN-OS, Prisma Access, and Cloud NGFW on AWS and Azure products, and flag **PAN-SA-2026-0012** for Chromium vulnerabilities affecting Prisma Browser versions before `151.26.5.170`. Palo Alto reported no known exploitation of CVE-2026-0310 in the wild as of September 9, 2026.
Sep 11, 2026
Palo Alto Networks disclosed and patched multiple vulnerabilities in **PAN-OS** affecting **PA-Series**, **VM-Series**, and **Panorama**, including `CVE-2026-0273`, an authenticated administrator command injection flaw in the **CLI** and **web management interface** that can allow arbitrary commands to run as **root**. The vendor also fixed `CVE-2026-0272`, an authenticated **CLI privilege escalation** issue, and `CVE-2026-0266`, a **stored XSS** vulnerability in the web interface. A separate issue, `CVE-2026-0269`, can trigger a **denial of service** through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode. Affected versions span supported **PAN-OS 12.1, 11.2, 11.1, and 10.2** release trains, while **Cloud NGFW** and **Prisma Access** were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for `CVE-2026-0273`, organizations with **Threat Prevention** can also enable dedicated **Threat IDs** to help block exploit attempts when management traffic is inspectable and decrypted.
Jun 29, 2026
Palo Alto Networks disclosed and patched **`CVE-2024-3400`**, a critical **CVSS 10.0** flaw in **PAN-OS** that allows unauthenticated attackers to achieve remote code execution through an arbitrary file creation issue leading to OS command injection. The vulnerability affects **PAN-OS 10.2, 11.0, and 11.1** when **GlobalProtect Gateway or Portal** is enabled, while **Cloud NGFW, Panorama appliances, and Prisma Access** are not affected. Volexity reported active in-the-wild exploitation, prompting Palo Alto to release hotfixes and Threat Prevention signatures **`95187`**, **`95189`**, and **`95191`** and to urge immediate upgrades. Post-compromise activity tracked by Unit 42 as **Operation MidnightEclipse** showed attackers gaining root-level execution on exposed firewalls, attempting limited data exfiltration, and establishing persistence. Researchers said the actor tried to deploy a custom Python backdoor called **UPSTYLE** and, when that failed, installed a cron-job backdoor instead. Updated guidance also clarified that disabling device telemetry is **not** an effective mitigation, and defenders were advised to patch immediately, enable threat prevention protections, and hunt for published indicators of compromise including malicious IPs, domains, URLs, and file hashes.
Aug 15, 2026