Unauthenticated RCE Risks Span Palo Alto, Fortinet and Cisco Products

Key points

• No CVE identifiers have been published, and a patched PAN-OS build is not yet available.
• Exposure covers every PAN-OS release, Panorama, PHP, a dozen Fortinet products, and 31 Cisco offerings.
• Attackers can attempt remote code execution without supplying credentials.
• Review vendor guidance and inventory affected systems immediately.

On 22 October 2026, Palo Alto Networks, Fortinet and Cisco published advisories describing unauthenticated remote code execution exposure in several product lines. No CVE identifiers have been assigned in the facts provided, and Palo Alto Networks has not yet issued a patched PAN-OS build. The vendors are directing customers to review affected products and apply available mitigations while fixes are prepared.

Palo Alto Networks' exposure touches every PAN-OS release and Panorama, with PHP also listed among the affected products. Fortinet's advisory covers a dozen products, while Cisco's spans 31 offerings. For K-12 and government environments, that breadth means internet-facing firewalls, management appliances and supporting web components all need to be checked rather than assumed safe.

Unauthenticated RCE is serious because an attacker does not need valid credentials to attempt exploitation. Even with a medium severity rating, the combination of remote access and no authentication raises the stakes for exposed management interfaces. Organizations should not wait for a CVE or a fixed PAN-OS release to reduce attack surface.

Context: the response so far is advisory-driven. Vendors have published guidance and asked customers to review product exposure. What to watch: a PAN-OS patch, CVE assignments, and any credible reports of exploitation. Until then, restrict administrative access, monitor logs, and keep an inventory of every affected Fortinet and Cisco device.

What to do now

1. Inventory every PAN-OS, Panorama, PHP, Fortinet and Cisco asset; record version, owner, and internet exposure.
2. Immediately restrict management interfaces and web-facing services to trusted networks or VPN; remove unnecessary public access.
3. Apply vendor-provided mitigations and compensating controls where no patch exists; prioritize internet-facing systems.
4. Subscribe to Palo Alto Networks, Fortinet and Cisco advisories; track the pending PAN-OS fix and any CVE assignment.
5. Enable and centralize logging for authentication, management, and web service activity; review for anomalous attempts.
6. Prepare a tested emergency patch window for PAN-OS, Panorama, Fortinet and Cisco products once fixes are available.
7. Segment affected appliances from critical K-12 data and report suspected exploitation to incident response.

Original source

Help Net Security