Palo Alto Networks has disclosed an exploited vulnerability in the PAN-OS management interface that can allow an authenticated attacker with network access to execute code with root privileges. Its advisory for CVE-2026-0322 was published on 14 October and updated on 15 October, with the company reporting very limited exploitation.
The vendor identifies PA-Series and VM-Series firewalls and Panorama as affected product families. Cloud NGFW and Prisma Access are not affected by this issue. Palo Alto Networks rates the vulnerability high severity and assigns its highest remediation urgency. Customers need to compare their deployed branch and build against the advisory’s specific fixed-version table, rather than apply one version number across the estate.
Management access is a material part of the exposure. The advisory says restricting it to trusted internal addresses reduces risk, but also states that there are no known workarounds. That distinction matters: reducing reachability does not remove the need for an appropriate fixed release. For financial institutions, this is an operational security item rather than evidence of an AI-enabled attack. The relevant governance lesson is to verify ownership of management interfaces and privileged access, including access delegated to automation, while avoiding any unsupported claim that agents caused the observed exploitation.
