Palo Alto PAN-OS Flaw CVE-2026-0322 Enables Root-Level Firewall Takeover

Key points

• CVE-2026-0322 affects Palo Alto Networks PAN-OS firewalls.
• Exploitation yields code execution with root privileges.
• Agencies must follow BOD 26-04 mitigation timeline.
• Admins should assess internet-facing exposure and patch or retire devices.

Palo Alto Networks has disclosed a security defect in its PAN-OS firewall operating system, tracked as CVE-2026-0322. The issue carries a medium severity rating, but its potential consequences are serious: an attacker who successfully exploits it could run their own code with the highest level of system permissions, effectively taking over the firewall. That level of access turns a perimeter device into a foothold for deeper network intrusion.

Organizations that run PAN-OS appliances are affected, particularly those with management interfaces or other services exposed to the public internet. K-12 districts and government agencies often rely on these firewalls as their primary boundary defense, so any compromise can undermine segmentation, logging, and access controls across the environment.

Why does this matter beyond a single appliance? A firewall running with root-level compromise can be silently reconfigured, used to intercept or redirect traffic, or leveraged to pivot into internal systems. Because the device sits at a trust boundary, attackers could disable protections, exfiltrate data, or establish persistence without triggering typical alerts. The medium score reflects exploitation complexity or prerequisites, not a limited blast radius.

Federal guidance is already in play. Binding Operational Directive 26-04 requires affected agencies to apply vendor mitigations on a defined schedule. Where no mitigation exists, the directive calls for discontinuing use of the product. That puts pressure on IT teams to quickly determine whether their PAN-OS instances can be secured or must be taken offline and replaced.

What to watch: Palo Alto Networks advisories for updated patches or workarounds, internal scans for internet-reachable management ports, and signs of unexpected root-level activity. Admins should treat this as a prompt to review exposure, enforce strict access controls, and prepare contingency plans for any appliance that cannot be remediated in time.

What to do now

1. Inventory every PAN-OS instance and identify which ones are reachable from untrusted networks or the public internet.
2. Apply vendor-supplied patches or mitigations immediately; if none are available, isolate or power down the affected firewall.
3. Restrict management access to dedicated internal interfaces and require multi-factor authentication for all administrative logins.
4. Follow BOD 26-04 reporting and remediation deadlines, documenting which systems are mitigated, isolated, or retired.
5. Review firewall and system logs for signs of root-level compromise, unexpected code execution, or unauthorized configuration changes.
6. Plan to replace any end-of-support appliance that cannot receive mitigations, and accelerate migration to a supported platform.
7. Reassess network segmentation and least-privilege rules to limit lateral movement if a perimeter device is breached.

Original source

CISA Known Exploited Vulnerabilities