Act
active
PAN-OS Authenticated RCE CVE-2026-0322 Actively Exploited, CISA KEV Listed
- Engineer — Act: CISA KEV listed plus a public PoC and confirmed active exploitation make this urgent — apply the PAN-OS patch immediately and restrict management interface access to trusted IP ranges only.
- SOC/IR — Act: Active exploitation of a perimeter security appliance warrants an assume-breach posture — hunt for anomalous management-plane activity and lateral movement from PAN-OS devices dating back to initial disclosure.
- Leader — Act: PAN-OS is perimeter infrastructure for many enterprises; confirm whether it is in use, verify engineering has an emergency patch window in progress, and be ready to respond to customer or board questions given the CISA KEV designation and confirmed active exploitation.
- Signals: CVE-2026-0322 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.