Act
active
Palo Alto PAN-OS RCE Zero-Day Actively Exploited (CVE-2026-0322)
- Engineer — Act: CISA KEV-listed, public PoC on GitHub, and confirmed active exploitation against PAN-OS firewalls — apply Palo Alto’s security updates immediately and verify no unauthorized access occurred pre-patch.
- SOC/IR — Act: Active exploitation of a perimeter firewall device warrants an assume-breach sweep — hunt for lateral movement or unusual outbound traffic from PAN-OS management IPs since the disclosure date, and tune detections for post-exploitation behavior on adjacent segments.
- Leader — Act: Actively exploited RCE on a widely deployed perimeter control warrants same-week action — confirm which sites run PAN-OS, verify patching is underway, and be ready to brief leadership if any firewall shows signs of compromise.
- Signals: CVE-2026-0322 — CISA KEV: listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.