Palo Alto Firewall Flaw Exploited — Patch, and Get Admin Off the Internet

Palo Alto has a firewall flaw under active attack, and CISA wants it patched by 17 October. But the patch is only half the fix — the real problem is where your firewall's admin page is listening.

On 14 October 2026, Palo Alto Networks disclosed CVE-2026-0322, an authenticated remote code execution flaw in the PAN-OS management interface, rated CVSS 8.6 and flagged with Palo Alto's highest urgency. An attacker who can reach that interface and has valid credentials can run code as root — in other words, take full control of the firewall that's meant to protect everything behind it. It affects PA-Series and VM-Series firewalls and Panorama; Cloud NGFW and Prisma Access are clear. There's no workaround, Palo Alto has seen limited exploitation in the wild, and CISA added it to its Known Exploited Vulnerabilities catalog the same day. It was one of four freshly exploited flaws CISA listed that day, alongside a critical Cisco Secure Email Gateway bug (CVSS 9.8) and a pair in Ahsay backup software.

Here's the part worth sitting with. This is authenticated RCE, so on paper an attacker needs a login. That sounds reassuring until you ask the obvious question: why is the firewall's management interface reachable from the internet at all? Palo Alto's own blunt advice is to get it off the public internet entirely — and that's the real lesson. In onboarding audits of new Australian clients, we keep finding firewall and VPN admin pages exposed to the whole world, protected by nothing but a password. When the admin interface is internet-facing, "authenticated" is one credential-stuffing run or one leaked password away from "game over." The patch closes this specific hole; locking down the interface closes the next ten.

What to Do This Week

• Patch affected devices now. Upgrade to a fixed PAN-OS release (10.2.18-h12, 11.1.16-h3, 11.2.16, 12.1.10-h2 or 12.2.4, or the relevant branch hotfix) ahead of any normal change window.
• Get the management interface off the internet. Restrict admin access to trusted internal IPs or a single jump box — this is the control that matters most.
• Separate management from data traffic. Your firewall's admin page should never sit on the same path your staff browse the web on.
• Name an owner for firewall firmware. Be clear on who tracks vendor advisories and applies updates — your team, your provider, or nobody in particular.

Written by Caleb Attard, All IT Services. All IT is a Sydney-based managed IT provider supporting businesses across Australia, including the Northern Beaches, Central West NSW, Brisbane and Melbourne.