Palo Alto Networks patches actively exploited PAN-OS zero-day (CVE-2026-0322)

En bref

• Palo Alto Networks has released patches for a zero-day in its PAN-OS firewall operating system.
• The flaw, CVE-2026-0322, enables remote code execution and potential firewall takeover.
• Attackers are already using the vulnerability in active campaigns, and an advisory has been issued.
• Administrators should apply updates without delay.

Palo Alto Networks has disclosed a previously unknown vulnerability in its PAN-OS firewall operating system, identified as CVE-2026-0322. The flaw permits an attacker to execute arbitrary code remotely, potentially leading to full control of the affected firewall. The company has confirmed that this zero-day has already been leveraged in real-world attacks, prompting an urgent security advisory.

Organizations relying on Palo Alto Networks firewalls for perimeter defense are at risk. This includes government agencies, educational institutions, and private enterprises that use these devices to protect their networks. Because firewalls sit at the edge of the network, a compromise can expose internal systems to further intrusion, data theft, or ransomware deployment.

The severity is high: remote code execution without authentication is a worst-case scenario for network security. Attackers who gain control of a firewall can manipulate traffic, disable security controls, or pivot deeper into the environment. The fact that exploits are already in circulation means that unpatched devices are actively being targeted.

Security patches have been issued by Palo Alto Networks to resolve the problem. Administrators should treat this as an emergency patch. If immediate updating is not feasible, temporary mitigations such as restricting management access to trusted IP addresses and enabling threat prevention signatures can reduce exposure. However, these are stopgaps, not substitutes for patching.

What to watch: monitor vendor channels for updated guidance, check firewall logs for anomalous activity, and verify that all instances are running the patched version. Given the active exploitation, time is critical. Any delay leaves networks vulnerable to a known, weaponized exploit.

À faire maintenant

1. Apply the latest PAN-OS security updates from Palo Alto Networks immediately.
2. If patching is delayed, restrict management interface access to trusted internal IPs only.
3. Enable and update threat prevention signatures to detect exploitation attempts.
4. Review firewall and network logs for signs of compromise, such as unusual outbound connections or configuration changes.
5. Isolate any suspected compromised firewall from the network and conduct forensic analysis.
6. Monitor Palo Alto Networks advisories for additional mitigations or indicators of compromise.
7. Verify that all firewall instances, including HA pairs, are patched and rebooted if required.

Références CVE

• CVE-2026-0322

Source originale

BleepingComputer