PAN-OS zero-day CVE-2026-0322: fixed versions and IoCs
Palo Alto has released fixed PAN-OS versions for zero-day CVE-2026-0322: versions by branch, attacker IPs, signatures and checks.
CVE-2026-0322 in Palo Alto Networks PAN-OS, the code injection in the management interface that lets an authenticated user run code as root, was added to the CISA KEV catalogue on 14 October 2026. In the following days the missing details arrived: the Palo Alto Networks advisory with the fixed versions for each branch, the IP addresses linked to the attacks, the Threat Prevention signatures and the full NIST assessment. The versions are confirmed by advisories from the Canadian Centre for Cyber Security, Korea’s KISA and Singapore’s CSA.
What the Palo Alto Networks advisory says
According to the vendor advisory, cited by BleepingComputer, SecurityWeek and CSO Online, “very limited” exploitation targeting the management interface has been observed. The vulnerability was discovered internally by Palo Alto Networks and, as SecurityWeek and CSO Online report, no special configuration is required to be exposed: it is enough for the management interface to be reachable by someone holding valid credentials.
The vendor says there are no known workarounds. The risk is highest when the management interface accepts connections from public IP addresses on the internet; the recommendation remains to restrict it to trusted internal addresses only.
The sources do not say when exploitation began, who is behind it, how many customers were affected or how the attackers obtained credentials. BleepingComputer and CSO Online asked Palo Alto Networks for details and had received no answer at the time of publication.
Fixed versions
The versions that fix the vulnerability, according to the KISA and Singapore CSA advisories (partly the same versions in the Canadian advisory):
- PAN-OS 12.2: 12.2.4
- PAN-OS 12.1: 12.1.4-h12, 12.1.7-h8, 12.1.10-h2
- PAN-OS 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16
- PAN-OS 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3
- PAN-OS 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12
Each hotfix applies to its own maintenance line: pick the one matching the installed version. According to BleepingComputer and CSO Online, 11.2.16 was expected on 15 October and is the upgrade path for those on 11.2.14 or 11.2.15; indeed it does not appear in the first version of the Canadian advisory, while it is in the KISA and CSA advisories of 16 October. Anyone running unsupported versions must move to a supported, fixed release. The affected products are still PA-Series and VM-Series firewalls and Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected.
Indicators and detection
BleepingComputer lists the three IP addresses that Palo Alto Networks associates with the exploitation; SecurityWeek confirms that the published indicators are a few IP addresses:
66.42.72[.]14208.83.239[.]114149.248.47[.]234
Customers with a Threat Prevention subscription can enable Threat IDs 510046 and 510047. According to CSO Online, citing the advisory’s FAQ, coverage is limited and requires SSL decryption of traffic to the management interface; variants of the attack may exist that the signatures do not detect. That is why Palo Alto Networks still recommends upgrading.
NIST assessment and the KEV catalogue
The NVD entry has moved to “Analyzed”. Alongside the CVSS 4.0 score of 8.6 assigned by Palo Alto, there is now NIST’s own: CVSS 3.1 7.2 (high), vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Both assessments are weighed down by the high privileges required (PR:H). Among the affected configurations NIST also includes versions earlier than 10.2.
The deadline CISA set for US federal agencies (17 October) has already passed. As CSO Online points out, the KEV entry also requires the forensic triage set out in Binding Operational Directive 26-04: checking whether the system was compromised before the patch was applied.
Attack chain
The sources do not describe the attack chain. The requirement for valid credentials and network access to the interface points in particular to T1078 (Valid Accounts) for initial access to the panel. An IDC analyst quoted by CSO Online believes the likely entry point is poor administrative access hygiene rather than the bug itself: credentials stolen through phishing or reused, interfaces left on the internet, earlier compromises. This is a hypothesis, not an established fact.
Impact for European and Italian companies
The picture from our previous article has not changed: the firewall controls the perimeter, and whoever gains root on a firewall or on Panorama can change its policies and configuration so as to stay in even after the upgrade. For NIS2 entities the upgrade should be tracked with documented priority and timelines, including when firewalls are managed by a supplier; any significant incident must be notified to the national CSIRT (in Italy, CSIRT Italia at ACN), and a compromise that exposes personal data must also be assessed under the GDPR.
What to do now
- Compare the version of every firewall and every Panorama with the list of fixed versions and upgrade to the hotfix for your maintenance line.
- Restrict the management interface to trusted internal IP addresses only, especially on devices you cannot upgrade right away.
- Enable Threat IDs 510046 and 510047 if you have Threat Prevention, bearing in mind that they require SSL decryption and give partial coverage.
- Search for the three IP addresses in the logs of the firewall, of Panorama and of your central log collection, starting from before 14 October.
- Review administrative access: accounts, connection sources, logins at unusual hours; change credentials and enable multi-factor authentication where available.
- Check the configuration of Panorama and of every managed firewall: unexpected changes to policies, accounts and access rules. Preserve logs and evidence before acting, as forensic triage requires.
How ARXDOME helps
With ARX Horizon you can search the portal for the IP addresses listed by Palo Alto Networks and check their reputation; ARX Sentry collects firewall logs in a central collector, so access to the management interface stays recorded outside the device too. ARX Expose shows open ports and recognised products on the services you expose on the internet: it helps you find out whether a management interface is reachable from outside.
Last updated:
