Palo Alto Networks has published updates for CVE-2026-0322 in PAN-OS, the operating system of its firewalls. The flaw lets an attacker who already has administrator credentials and access to the management interface run code with root privileges. The company reports very limited exploitation and advises allowing management access only from a trusted internal system. The US agency CISA has added the flaw to its catalogue of actively exploited vulnerabilities.

What it means: The flaw requires authentication, so it is not open to anyone on the internet, but that does not make it harmless. In practice attackers often obtain admin passwords through phishing, leaks or reused credentials, then use flaws like this to take full control of the firewall. A compromised firewall exposes traffic rules, VPN connections and information about the whole internal network. Palo Alto firewalls are widely used by Greek banks, service providers and large companies. The most important defence is organisational: the management interface should never be reachable from the internet or the general corporate network, only from a dedicated management workstation. Administrator accounts also need multi-factor authentication and regular review. After patching, it is worth checking for unusual configuration changes or new accounts. For financial entities, DORA requires documented vulnerability management, so a quick response and a record of the steps taken are a compliance matter as well as a security one. Smaller firms that rely on an IT partner should confirm that the partner tracks the CISA catalogue and has a clear deadline for applying fixes to edge devices such as this.

Read the original on Palo Alto Networks

Related service: Custom software

Related stories