What the vendor disclosed
Palo Alto Networks published an advisory for CVE-2026-0322, rated high severity (CVSS 8.6). The flaw may allow remote code execution as root, but the described exploitation requires network access to the management interface and a highly privileged account.
Affected product scope
The advisory covers certain PAN-OS versions on PA-Series, VM-Series and Panorama appliances. Palo Alto says Cloud NGFW and Prisma Access are not affected. Administrators should check exact releases in the vendor table rather than generalise to the entire portfolio.
Observed exploitation and limits
The vendor characterises observed exploitation as very limited. CISA’s Known Exploited Vulnerabilities listing makes remediation a priority, but does not prove any particular network was targeted or compromised. The advisory does not provide a complete victim list.
Immediate actions
Inventory PAN-OS and Panorama instances, compare versions with the advisory and apply the appropriate fix. Check that management interfaces are not exposed to unnecessary networks, reduce privileged accounts and review logs for unusual administrative connections.
After patching
The fix reduces exposure to this CVE but does not rule out earlier compromise. If the interface was unusually reachable or logs show suspicious activity, preserve evidence, have the appliance reviewed and rotate administrative secrets from a trusted workstation. Our team password-management guide explains how to coordinate rotation.
Soclyde’s role
Soclyde can help manage unique passwords for administrator accounts and remove access that is no longer needed. It does not patch PAN-OS or replace network segmentation, logging or incident response procedures.
