Palo Alto Networks has confirmed that attackers are already exploiting a serious flaw in the management interface of its PAN-OS firewalls. Businesses using these firewalls should act now.

• What it is: A remote code execution flaw (CVE-2026-0322) that lets an attacker who can reach the management interface run commands with full control of the firewall.
• Who is affected: PA-Series and VM-Series firewalls and Panorama management systems. Cloud NGFW and Prisma Access are not affected.
• The risk: Palo Alto describes the attacks as very limited so far, but the flaw has been added to the US CISA list of actively exploited vulnerabilities, and a compromised firewall can expose your entire network.
• What to do: Install the fixed PAN-OS releases from Palo Alto, and until then restrict management interface access to trusted internal addresses only, never the open internet.

We recommend checking your firewall version today and contacting us if you would like help confirming it is patched and locked down.

Source: The Hacker News