Palo Alto Networks alerts on critical PAN-OS RCE zero-day exploited in the wild
Palo Alto Networks has released patches for CVE-2026-0322, a critical remote code execution vulnerability actively exploited in PAN-OS firewalls, posing major risks to enterprise networks.
Why it matters
Active exploitation of this critical firewall vulnerability increases the risk of unauthorized access within enterprise environments, potentially undermining network defenses.
SOC impact
Detect and monitor for indicators related to CVE-2026-0322 exploitation attempts against PAN-OS firewalls. Validate inventory of affected devices and review firewall telemetry for suspicious activity linked to remote code execution attempts.
Recommended actions
- Identify and inventory PAN-OS firewall models within the environment
- Review firewall logs for unusual or unauthorized activity correlating with the vulnerability
- Monitor network telemetry for signs of exploitation attempts targeting PAN-OS
- Consult Palo Alto Networks advisory for specific vulnerability details and patches
- Assess and prioritize response based on exposure and criticality of affected assets
Executive Summary
Palo Alto Networks has disclosed an actively exploited remote code execution vulnerability identified as CVE-2026-0322 in their PAN-OS firewall platform. This flaw enables attackers to execute arbitrary code, posing a significant operational threat to organizations relying on these devices for perimeter defense. Given the active exploitation in the wild, network defenders must promptly assess the presence of affected firewalls and increase monitoring for suspicious activity potentially related to this vulnerability. Confirming impacted assets and detecting attempts at exploitation are essential steps to maintain network security posture until mitigations or patches are fully applied.
SOC Impact
Detect and monitor for indicators related to CVE-2026-0322 exploitation attempts against PAN-OS firewalls. Validate inventory of affected devices and review firewall telemetry for suspicious activity linked to remote code execution attempts.
Firewall Vulnerability Validation and Monitoring
- Identify and inventory PAN-OS firewall models within the environment
- Review firewall logs for unusual or unauthorized activity correlating with the vulnerability
- Monitor network telemetry for signs of exploitation attempts targeting PAN-OS
- Consult Palo Alto Networks advisory for specific vulnerability details and patches
- Assess and prioritize response based on exposure and criticality of affected assets
Why It Matters
Active exploitation of this critical firewall vulnerability increases the risk of unauthorized access within enterprise environments, potentially undermining network defenses.