Palo Alto Networks has released security updates for a high-severity vulnerability in PAN-OS, its firewall operating system, and said the issue is under active exploitation. For businesses that rely on Palo Alto firewalls to protect networks, remote sites or cloud environments, the development is a priority because it affects the management interface and could allow unauthorised code execution under certain conditions.

What happened

The issue is tracked as CVE-2026-0322 and has been assigned a CVSS score of 8.6. According to Palo Alto Networks, it is a remote code execution vulnerability in the PAN-OS management interface. The company has issued security updates and indicated that exploitation has already been observed in the wild.

Based on the available information, the flaw affects PAN-OS software rather than a consumer product. The key business concern is that management interfaces are highly sensitive administrative surfaces. If exposed or insufficiently protected, they can become a path to broader compromise of security infrastructure.

Why it matters for European businesses

Firewalls often sit at the edge of corporate networks and protect critical traffic between offices, cloud services, remote workers and internal systems. A compromise involving the management interface can be especially serious because attackers may gain privileged access to a security device that is meant to defend the organisation.

For European businesses, this matters beyond the immediate technical risk:

• Operational disruption: If a perimeter security device is compromised, incident response may require urgent isolation, configuration review and emergency maintenance.
• Broader security exposure: Attackers who gain control of a firewall management plane may be able to change rules, intercept traffic paths or use the device as a foothold for further attacks.
• Compliance and governance implications: Organisations in regulated sectors may need to assess whether the incident creates reporting, audit or risk management consequences under their internal policies or applicable rules.
• Supply chain and managed service impact: Businesses using IT providers or managed security partners should confirm whether those partners manage affected appliances and whether patching has been scheduled.

The presence of active exploitation increases urgency. Even companies with strong patching routines often prioritise vulnerabilities differently when there is evidence that attackers are already using them.

Who may be affected

The most directly affected organisations are those using Palo Alto Networks firewalls running vulnerable PAN-OS versions, especially where the management interface is reachable from untrusted networks or where administrative access controls are weak.

This may include:

• SMEs with Palo Alto appliances protecting headquarters, branches or hybrid work environments
• E-commerce businesses that depend on secure network access for payment, website hosting or back-office systems
• Companies with cloud and on-premise environments managed through PAN-OS devices
• IT teams and managed service providers responsible for firewall administration
• Regulated organisations that must maintain stronger security oversight and documented remediation processes

What companies should consider

Businesses using Palo Alto Networks equipment should first verify whether their PAN-OS versions are affected and whether vendor-provided patches are available for their deployments. If affected systems are in use, security teams should assess patching as a high-priority task.

• Identify exposure: Inventory PAN-OS systems and confirm whether any management interfaces are internet-accessible or otherwise reachable from untrusted segments.
• Apply vendor updates: Review Palo Alto Networks security guidance and install the relevant fixes as soon as operationally feasible.
• Restrict administrative access: Limit management interface exposure to trusted IP ranges, VPN access or dedicated administration networks where possible.
• Review authentication controls: Check administrator accounts, multi-factor authentication settings and privileged access policies tied to firewall management.
• Look for signs of compromise: Review logs, recent configuration changes, new accounts and unusual management activity, particularly if patching has been delayed.
• Coordinate with providers: If infrastructure is managed by a third party, ask for confirmation of exposure, mitigation steps and patch status.

Where organisations suspect compromise, the response should go beyond patching alone. They may need a fuller forensic review, credential rotation and validation of firewall policies and system integrity. Because the vulnerability is reportedly being actively exploited, delayed action can increase the risk of a wider incident.