Palo Alto Networks Warns of Security Vulnerabilities Affecting Multiple PAN-OS Versions

Palo Alto Networks has released security updates addressing multiple vulnerabilities in its PAN-OS operating system, which powers the company’s network firewalls. The disclosures have raised concerns among cybersecurity professionals because some of the affected versions contain weaknesses that could allow attackers to compromise systems if the vulnerabilities remain unpatched. According to security advisories published in October 2026, the affected software includes several releases across the PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 branches. The issues vary in severity, with potential consequences including denial of service, unauthorised access and remote code execution. Administrators have been urged to check their installed versions and apply the appropriate security updates.

One of the most significant disclosures concerns CVE-2026-0322, a high-severity vulnerability in the PAN-OS management interface. Palo Alto Networks assigned the flaw a CVSS 4.0 score of 8.6 out of 10. According to cybersecurity authorities, an authenticated attacker with network access to the management interface could exploit the weakness to execute arbitrary code with root privileges on an affected firewall. This level of access could potentially allow an attacker to interfere with firewall operations or compromise the security of the environment the device protects. The company has reported limited exploitation attempts, while the Cybersecurity and Infrastructure Security Agency in the United States added the vulnerability to its Known Exploited Vulnerabilities catalogue in October.

The vulnerability affects multiple PAN-OS software branches, including versions of 10.2, 11.1, 11.2, 12.1 and 12.2 that fall below specified fixed releases. The exact update required depends on the installed branch and maintenance version. The issue also affects Panorama deployments, which administrators use to manage firewall infrastructure centrally. However, authorities have clarified that Cloud NGFW and Prisma Access are not affected by CVE-2026-0322. Organisations should therefore consult the official security advisory rather than assume that every Palo Alto Networks product is vulnerable in the same way. The broader October advisories also address separate weaknesses, meaning administrators need to review all relevant notices when determining their exposure.

Cybersecurity agencies are advising affected organisations to prioritise remediation, particularly where firewall management interfaces can be reached from the public internet. Restricting management access to trusted internal networks and authorised addresses can reduce exposure, but it should not be treated as a substitute for installing the appropriate security updates. Security teams should also review access logs, examine available indicators of compromise and investigate suspicious administrative activity. These measures are especially important for organisations that manage sensitive information or operate critical services, including financial institutions, healthcare providers, government departments and telecommunications companies. Because firewalls are designed to protect other systems, a successful compromise could have consequences extending beyond the vulnerable device itself.

The latest disclosures highlight the continuing challenge of securing the infrastructure that organisations rely on to defend their networks. Even security products can contain software vulnerabilities, making regular patching, restricted administrative access and continuous monitoring essential parts of cybersecurity management. Organisations using PAN-OS should identify their installed versions, follow Palo Alto Networks’ official remediation instructions and confirm that updates have been applied successfully. They should also maintain an incident-response plan in case investigations reveal evidence of exploitation. Although the company has reported limited exploitation of CVE-2026-0322, the inclusion of the flaw in government tracking systems demonstrates that it requires urgent attention. Prompt remediation and careful monitoring remain the most effective steps for reducing the risk posed by the disclosed vulnerabilities.