Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322) is being actively exploited, CISA warns
CISA added CVE-2026-0322 (Palo Alto Networks PAN-OS) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Excerpt from the primary source: CISA Known Exploited Vulnerabilities
Who is affected
Enterprises
Affected technology: PAN-OS / GlobalProtect
Why it matters
CISA lists this as exploited in the wild. Unpatched PAN-OS / GlobalProtect systems are exposed to active attacks now.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Patch
Apply the vendor's security update for PAN-OS / GlobalProtect. Check the linked advisory for affected and fixed versions, and put internet-facing systems first.
CISA's required action for CVE-2026-0322: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." US federal civilian agencies must comply by October 17, 2026.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
Source reporting says attackers are already exploiting this, so exposed Cisco networking & security systems are at immediate risk.
Treat this as an emergency.
ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
ABB previously published an advisory warning about possible probing of a dynovaPRO vulnerability.
Microsoft fixes VPN issues caused by September Windows updates
Microsoft has resolved a known issue that caused Always On VPN connection issues after installing the September 2026 Windows 11 security updates.
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged security teams to immediately patch an Ivanti Connect Secure (ICS) flaw exploited in zero-day attacks since at least October 1st.
Source reporting says attackers are already exploiting this, so exposed Ivanti Connect Secure / EPMM systems are at immediate risk.
Treat this as an emergency.