Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.
Excerpt from the primary source: SecurityWeek
Who is affected
Enterprises · Security professionals
Affected technology: PAN-OS / GlobalProtect
Why it matters
Source reporting says attackers are already exploiting this, so exposed PAN-OS / GlobalProtect systems are at immediate risk.
Automated: stated only from CISA listings and the exploitation evidence in the sources below.
What you should do · Act now
Treat this as an emergency. Identify every system running PAN-OS / GlobalProtect, apply the vendor's fix or published mitigations immediately, and check for signs of compromise. Patching alone does not remove an attacker who already got in.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
Ahsay AhsayCBS Command Injection Vulnerability (CVE-2026-105134) is being actively exploited, CISA warns
CISA added CVE-2026-105134 (Ahsay AhsayCBS) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s…
CISA lists this as exploited in the wild. Unpatched AhsayCBS and Cisco networking & security systems are exposed to active attacks now.
Treat this as an emergency.
Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322) is being actively exploited, CISA warns
CISA added CVE-2026-0322 (Palo Alto Networks PAN-OS) to its Known Exploited Vulnerabilities catalog on October 14, 2026, which means there is reliable evidence of exploitation in the wild. Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
CISA lists this as exploited in the wild. Unpatched PAN-OS / GlobalProtect systems are exposed to active attacks now.
Apply the vendor's security update for PAN-OS / GlobalProtect.
Cisco patches new Secure Email Gateway zero-day exploited in attacks
Cisco has patched another actively exploited zero-day flaw in its Secure Email Gateway (SEG) that lets remote unauthenticated attackers execute commands with root privileges.
Source reporting says attackers are already exploiting this, so exposed Cisco networking & security systems are at immediate risk.
Treat this as an emergency.
ICS Patch Tuesday: Siemens Issues 17 Advisories, Rockwell Fixes ArmorBlock Takeover Flaw
ABB previously published an advisory warning about possible probing of a dynovaPRO vulnerability.