CISA Cybersecurity Directives & Advisories Brief

Headline

CISA adds actively exploited Palo Alto PAN-OS remote code execution flaw to Known Exploited Vulnerabilities Catalog with October 17 remediation deadline

Executive Summary

CVE-2026-0322, a remote code execution flaw in the PAN-OS management interface, was published by NIST's National Vulnerability Database on October 14, 2026, affecting PA-Series and VM-Series firewalls and Panorama. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog the same day. Federal agencies must apply mitigations by October 17, 2026, under Binding Operational Directive 26-04.

Bottom Line

CVE-2026-0322 is an actively exploited remote code execution vulnerability in the PAN-OS management interface that allows an authenticated, network-adjacent attacker to execute arbitrary code with root privileges on affected PA-Series and VM-Series firewalls and Panorama appliances. CISA's Known Exploited Vulnerabilities Catalog entry, added October 14, 2026, sets an October 17, 2026 deadline for federal agencies to apply vendor mitigations or discontinue use of the product under BOD 26-04. Palo Alto Networks states that restricting management interface access to trusted internal IP addresses reduces the risk, and that Cloud NGFW and Prisma Access are not affected. Cresthaven reading: the three-day federal remediation window and confirmed active exploitation place this vulnerability at the top of remediation queues for any organization running affected PAN-OS versions on internet-exposed or network-accessible management interfaces.

Key Regulatory Signals

• Active Exploitation Confirmed: CISA's addition of CVE-2026-0322 to the Known Exploited Vulnerabilities Catalog confirms the vulnerability is being actively exploited in the wild. The catalog entry was added October 14, 2026, with a required action deadline of October 17, 2026, a three-day remediation window under Binding Operational Directive 26-04.
• Scope of Affected Platforms: The vulnerability affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama, both virtual and M-Series appliances. Palo Alto Networks states that Cloud NGFW and Prisma Access are not impacted. Affected PAN-OS version ranges include all versions below 10.2.0 and versions from 12.2.0 up to but excluding 12.2.4, along with specific 10.2.7, 10.2.8, 10.2.9, and 10.2.10 hotfix builds enumerated in the NVD record.
• Root-Level Code Execution via Management Interface: An authenticated attacker with network access to the management interface can execute arbitrary code with root privileges on the firewall. Palo Alto Networks states the risk is minimized by restricting management interface access to trusted internal IP addresses per its published best practice deployment guidelines.
• Forensic Triage Requirement Attached: CISA's required action directs stakeholders to apply vendor mitigations in accordance with BOD 26-04, comply with CISA's Forensics Triage Requirements, and evaluate each asset's internet exposure. Where mitigations are unavailable, CISA instructs stakeholders to discontinue use of the product. Cresthaven reading: organizations operating affected PAN-OS deployments outside the federal civilian executive branch sit outside BOD 26-04's binding scope, but the catalog entry and three-day federal deadline signal the severity level that informs voluntary remediation prioritization across any sector.

Regulatory Delta

• CISA has previously catalogued PAN-OS management-interface flaws; the three-day remediation window here matches the shortest intervals the agency has applied to actively exploited network-device vulnerabilities.
• The NVD record classifies the weakness as CWE-94 (code injection), and the described outcome is arbitrary code execution with root privileges on the firewall. Palo Alto Networks is identified as the weakness source.
• This signals CISA's continued use of the KEV mechanism as its primary instrument for federal patch prioritization.

Materiality Classification

HIGH — CISA has added CVE-2026-0322 to the Known Exploited Vulnerabilities Catalog with a binding three-day remediation deadline under BOD 26-04, confirming active exploitation of a root-privilege remote code execution flaw across a widely deployed enterprise firewall platform.

Time Horizon

implementation — 2026-10-17

Intelligence Outlook

Monitor CISA's Known Exploited Vulnerabilities Catalog and Palo Alto Networks' security advisories for updated mitigation guidance, patch availability, and any expansion of the affected version list before October 17, 2026.