# CVE-2026-0322 exploited in Palo Alto Networks products

Published: 2026-10-15 · Severity: severe · Sectors: technology, government-national, defense, financial-services, telecommunications, energy, healthcare, manufacturing
Canonical: https://vorant.io/reports/bc3a194c-3b66-5ce4-b8ef-2e18f0e9a417/cve-2026-0322-exploited-in-palo-alto-networks-products

> CERT-FR warns of multiple Palo Alto Networks vulnerabilities including actively exploited CVE-2026-0322, enabling RCE, privilege escalation and DoS.

CERT-FR issued an advisory covering numerous vulnerabilities across the Palo Alto Networks product portfolio, including PAN-OS, GlobalProtect App, Prisma Access, Prisma Browser, Cortex XSIAM/XSOAR OS Query, and Checkov by Prisma Cloud. The flaws collectively allow security policy bypass, remote denial of service, remote arbitrary code execution, server-side request forgery (SSRF), indirect code injection (XSS), privilege escalation, and other unspecified impacts depending on the specific CVE and affected product.

Palo Alto Networks has confirmed that CVE-2026-0322 is being actively exploited in the wild, making it the priority patch item in this bulletin. A very large number of additional CVEs are referenced across the vendor's bulletins (PAN-SA-2026-0013 and numerous individual CVE bulletins dated 14 October 2026), affecting many version branches of PAN-OS (10.2.x through 12.x), GlobalProtect App (6.0.x-6.3.x), Prisma Access, Prisma Browser, and Cortex XSIAM/XSOAR components. A fix for PAN-OS 11.2.6 is still pending.

Defenders running any Palo Alto Networks products should prioritize identifying and patching the version ranges listed as affected, with special urgency for systems susceptible to CVE-2026-0322 given confirmed in-the-wild exploitation. Organizations should consult the vendor's security bulletins for patch availability and apply updates per the fixed version matrix provided.

## Mentioned in this report

- Vulnerabilities: CVE-2026-0311, CVE-2026-0312, CVE-2026-0313, CVE-2026-0314, CVE-2026-0315, CVE-2026-0316, CVE-2026-0317, CVE-2026-0318, CVE-2026-0319, CVE-2026-0320, CVE-2026-0321, CVE-2026-0322 (KEV), CVE-2026-102299, CVE-2026-102300, CVE-2026-102301, CVE-2026-102302, CVE-2026-102303, CVE-2026-102304, CVE-2026-102305, CVE-2026-102306, CVE-2026-102307, CVE-2026-102308, CVE-2026-102309, CVE-2026-102310, CVE-2026-106185, CVE-2026-106196, CVE-2026-106244, CVE-2026-106393, CVE-2026-106401, CVE-2026-106404, CVE-2026-106408, CVE-2026-106414, CVE-2026-106426, CVE-2026-85042, CVE-2026-85043, CVE-2026-85044, CVE-2026-85045, CVE-2026-85046 (KEV), CVE-2026-85047, CVE-2026-85048

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1326

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bc3a194c-3b66-5ce4-b8ef-2e18f0e9a417/cve-2026-0322-exploited-in-palo-alto-networks-products.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup