CVE-2026-0322 exploited in Palo Alto Networks products
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CERT-FR warns of multiple Palo Alto Networks vulnerabilities including actively exploited CVE-2026-0322, enabling RCE, privilege escalation and DoS.
CERT-FR issued an advisory covering numerous vulnerabilities across the Palo Alto Networks product portfolio, including PAN-OS, GlobalProtect App, Prisma Access, Prisma Browser, Cortex XSIAM/XSOAR OS Query, and Checkov by Prisma Cloud. The flaws collectively allow security policy bypass, remote denial of service, remote arbitrary code execution, server-side request forgery (SSRF), indirect code injection (XSS), privilege escalation, and other unspecified impacts depending on the specific CVE and affected product.
Palo Alto Networks has confirmed that CVE-2026-0322 is being actively exploited in the wild, making it the priority patch item in this bulletin. A very large number of additional CVEs are referenced across the vendor's bulletins (PAN-SA-2026-0013 and numerous individual CVE bulletins dated 14 October 2026), affecting many version branches of PAN-OS (10.2.x through 12.x), GlobalProtect App (6.0.x-6.3.x), Prisma Access, Prisma Browser, and Cortex XSIAM/XSOAR components. A fix for PAN-OS 11.2.6 is still pending.
Defenders running any Palo Alto Networks products should prioritize identifying and patching the version ranges listed as affected, with special urgency for systems susceptible to CVE-2026-0322 given confirmed in-the-wild exploitation. Organizations should consult the vendor's security bulletins for patch availability and apply updates per the fixed version matrix provided.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1326
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs