Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix
Summary
Attackers are actively exploiting a critical vulnerability (CVE-2026-0322) in Palo Alto Networks' PAN-OS software, allowing for arbitrary code execution with root privileges. The US Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch it by October 17, with requirements for forensic triage to detect prior compromise.
IFF Assessment
This article details an actively exploited vulnerability that grants attackers root access to critical firewall infrastructure, posing a significant threat to defenders.
Severity
The article states the flaw was rated 8.6 on the CVSS 4.0 scale, indicating a high severity score due to its ability to allow an authenticated attacker with network access to execute arbitrary code with root privileges.
CISA KEV: Listed as actively exploited. Federal patch due: October 17, 2026. Known ransomware use: Unknown.
Defender Context
This vulnerability allows attackers to gain root access and execute arbitrary code on Palo Alto Networks firewalls, a critical component for network security. Defenders must prioritize patching this vulnerability and conduct thorough forensic analysis to detect any prior exploitation or persistent threats.