A critical zero-day flaw exploitable on PAN-OS firewalls

Palo Alto Networks announced on October 14, 2026, a critical zero-day flaw, tracked as CVE-2026-0322, affecting its PAN-OS operating system. This remote code execution (RCE) vulnerability allows an authenticated attacker with network access to the management interface to execute arbitrary commands with root privileges on vulnerable devices. According to Palo Alto Networks, this flaw is already being exploited in limited attacks specifically targeting the management interface of firewalls.

The flaw impacts PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2, deployed on PA-Series, VM-Series, virtual appliances Panorama, and M-Series devices. The Cloud NGFW and Prisma Access solutions are not affected, the vendor clarifies. The severity of this vulnerability is rated 8.6 out of 10 by the CVSS scoring system, making it a major threat to critical infrastructures.

Exposure to external IP addresses significantly increases the risks of exploitation of this critical flaw.

Patches available, but challenges for legacy systems

Palo Alto Networks has released patches for affected PAN-OS versions, with a specific update for version 11.2.16 scheduled for October 15, 2026. However, users running unsupported versions are advised to migrate to a maintained release, as no workaround exists for this flaw, according to the vendor’s security advisories. Subscribers to the Threat Prevention service can enable signatures Threat ID 510046 and 510047 for limited protection against known attacks, provided SSL decryption is enabled.

The company strongly recommends restricting access to the management interface to trusted internal IP addresses only, a practice already encouraged in deployment best practices. This measure significantly reduces the risk of exploitation, as the attack requires valid credentials and network access. Palo Alto Networks emphasizes that exposure to external IP addresses considerably increases risks.

An alert from the CISA and a correction deadline imposed on U.S. administrations

The CISA (Cybersecurity and Infrastructure Security Agency) has included the vulnerability CVE-2026-0322 in its catalog of known exploited vulnerabilities, requiring U.S. civilian federal agencies to fix this vulnerability by October 17, 2026. This decision reflects the urgency of the situation and the recognition by U.S. cybersecurity authorities of the threat level posed by this vulnerability. Although this requirement does not directly apply to Beninese or African organizations, it underscores the importance of addressing this vulnerability without delay.

This vulnerability was discovered internally by Suraj Siddharudh, a principal product security researcher at Palo Alto Networks. The vendor emphasizes that observed exploitation remains very limited at this stage, but warns of the risk of seeing more targeted attacks or undetected variants that evade current signatures.

What this means here: risks and actions for businesses and administrations in West Africa

For businesses and administrations in Benin and West Africa using Palo Alto Networks firewalls, this vulnerability could compromise the security of critical infrastructures if systems remain exposed. A successful exploitation would allow attackers to gain full control of devices, with potential consequences for data confidentiality, integrity, and availability. Organizations relying on PAN-OS should prioritize updating vulnerable versions and strictly apply access restriction recommendations for the management interface.

Public administrations, often prime targets in ransomware or espionage attacks, could see their resilience strengthened by fixing this vulnerability before it is exploited on a large scale. Financial sector companies or telecommunications firms, which frequently use firewalls to secure their networks, should also assess their exposure and implement fixes as soon as they are available. Finally, managed service providers (MSPs) managing client infrastructures equipped with PAN-OS should alert their clients and assist them in updating to avoid incidents related to negligence.