Palo Alto's firewall bug is already under attack. Your admin page is the doorway.
By Lior AharonovFounder, 7IT Solutions ·
On 14 October 2026 Palo Alto Networks warned of CVE-2026-0322, a root code execution flaw in the PAN-OS management interface scored 8.6, with very limited exploitation that needs credentials and network access to that interface. CISA added it to its exploited list the same day, due 17 October. Fixes exist for 10.2, 11.1, 11.2, 12.1 and 12.2, with an 11.2.16 fix expected 15 October, per BleepingComputer.
A firewall sits in front of everything you run. Whoever gets root on it sees the traffic going in and out. Attackers still need a login, which makes an admin page open to the internet the weak spot.
If you run PAN-OS, limit management interface access to trusted internal IPs today, then install the fixed release for your branch. Run Palo Alto's Threat Prevention signatures meanwhile, but do not rely on them alone.
The login is not your safety net. If the admin page answers the whole internet, you are one stolen password from a stranger with root.
Lior Aharonov · my takeSources
Researched with AI tools; every fact is checked against the linked sources.