/
← Voltar ao feed
critical

CERT-FR: Multiple Palo Alto Networks vulnerabilities, including RCE; CVE-2026-0322 actively exploited

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 21:00 · coletado há 10 horas

CERT-FR advisory CERTFR-2026-AVI-1317 is not the source here; this record covers CERTFR-2026-AVI-1326, which reports multiple vulnerabilities in Palo Alto Networks products fixed in vendor bulletins of October 14, 2026. Some flaws allow remote arbitrary code execution, privilege escalation and remote denial of service. Other impact classes listed are security policy bypass, SSRF and indirect XSS. Palo Alto Networks states that CVE-2026-0322 is actively exploited. The advisory gives no technical details, IOCs or attribution, and it references well over 150 CVEs in total, with individual bulletins for CVE-2026-0311 to CVE-2026-0322 and PAN-SA-2026-0013.

Technical Details

  • Affected products: PAN-OS (10.2, 11.1, 11.2 and 12.1 branches, each before specific hotfix builds, plus versions before 11.2.16 and before 12.2.4), GlobalProtect App 6.0.x before 6.0.15, 6.2.x before 6.2.8-h15 and 6.3.x before 6.3.3-h16, Prisma Access before 10.2.0, 11.2.0 and 12.1.0 without the latest security patches, Prisma Browser before 152.8.5.83, Checkov by Prisma Cloud 3.3.x before 3.3.25 and 3.2.x before 3.2.533, and Cortex XSIAM and Cortex XSOAR OS Query before 1.0.17.
  • A fix for PAN-OS 11.2.6 is still pending publication.
  • The advisory does not map impacts to individual CVEs.

Remediation

  • Apply the fixed versions listed in the Palo Alto Networks security bulletins, starting with CVE-2026-0322, which is under active exploitation.
  • For PAN-OS 11.2.6, where no fix is available yet, follow the vendor bulletin for guidance and monitor for the patch release.
  • Inventory PAN-OS firewalls, GlobalProtect clients and Prisma Access tenants to identify vulnerable builds.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 14/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

    CERT-FR: Multiple Palo Alto Networks vulnerabilities, including RCE; CVE-2026-0322 actively exploited

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1317 is not the source here; this record covers CERTFR-2026-AVI-1326, which reports multiple vulnerabilities in Palo Alto Networks products fixed in vendor bulletins of October 14, 2026. Some flaws allow remote arbitrary code execution, privilege escalation and remote denial of service. Other impact classes listed are security policy bypass, SSRF and indirect XSS. Palo Alto Networks states that CVE-2026-0322 is actively exploited. The advisory gives no technical details, IOCs or attribution, and it references well over 150 CVEs in total, with individual bulletins for CVE-2026-0311 to CVE-2026-0322 and PAN-SA-2026-0013.

    Technical Details

    • Affected products: PAN-OS (10.2, 11.1, 11.2 and 12.1 branches, each before specific hotfix builds, plus versions before 11.2.16 and before 12.2.4), GlobalProtect App 6.0.x before 6.0.15, 6.2.x before 6.2.8-h15 and 6.3.x before 6.3.3-h16, Prisma Access before 10.2.0, 11.2.0 and 12.1.0 without the latest security patches, Prisma Browser before 152.8.5.83, Checkov by Prisma Cloud 3.3.x before 3.3.25 and 3.2.x before 3.2.533, and Cortex XSIAM and Cortex XSOAR OS Query before 1.0.17.
    • A fix for PAN-OS 11.2.6 is still pending publication.
    • The advisory does not map impacts to individual CVEs.

    Remediation

    • Apply the fixed versions listed in the Palo Alto Networks security bulletins, starting with CVE-2026-0322, which is under active exploitation.
    • For PAN-OS 11.2.6, where no fix is available yet, follow the vendor bulletin for guidance and monitor for the patch release.
    • Inventory PAN-OS firewalls, GlobalProtect clients and Prisma Access tenants to identify vulnerable builds.