Our automated tracking framework flagged that CISA added CVE-2026-0322 (Palo Alto Networks PAN-OS) to the Known Exploited Vulnerabilities (KEV) catalog on October 18, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-0322 by October 17, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-0322 |
| Vendor / product | Palo Alto Networks PAN-OS |
| Vulnerability | Palo Alto Networks PAN-OS Code Injection Vulnerability |
| CVSS base score | 7.2 |
| Added to KEV | October 14, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | October 17, 2026 |
| Known ransomware use | No |
How This Compares to Palo Alto Networks’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published.
| Palo Alto Networks in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 16 |
| Median lag (public → KEV listing) | 10 days |
| 0-day rate (exploited at or before disclosure) | 31% |
| Entries tied to known ransomware campaigns | 5 |
For perspective, the median across all 1748 tracked KEV entries is 239 days — Palo Alto Networks’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Palo Alto Networks KEV Additions
The most recent Palo Alto Networks vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-0257 | PAN-OS | May 29, 2026 | 16 | No |
| CVE-2026-0300 | PAN-OS | May 6, 2026 | 0 | No |
| CVE-2025-0111 | PAN-OS | February 20, 2025 | 8 | No |
| CVE-2025-0108 | PAN-OS | February 18, 2025 | 6 | No |
| CVE-2024-3393 | PAN-OS | December 30, 2024 | 3 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-0322, a code injection vulnerability in Palo Alto Networks PAN-OS, to its Known Exploited Vulnerabilities (KEV) catalog. This immediately signals urgent patching, especially for federal agencies facing an October 17, 2026, deadline. The vulnerability has a CVSS base score of 7.2. Its addition to the KEV catalog confirms active exploitation, making organizations using PAN-OS exposed and primary targets for immediate action. Code injection vulnerabilities like this one can grant attackers significant control, so patching is critical.
This CVE was added to the KEV catalog with zero days of lag from its public disclosure. That suggests exploitation likely began very quickly after details became known, or possibly even before public disclosure. This zero-day lag indicates a narrow detection window and emphasizes that proactive patching is paramount. While there’s no known ransomware use associated with this CVE yet, taking pre-emptive action is crucial for protecting sensitive network infrastructure.
Organizations must patch before October 17, 2026. If you can’t apply the patch before the federal deadline, restrict access to PAN-OS devices. Implement network segmentation and deploy intrusion detection/prevention systems (IDS/IPS) to monitor for anomalous activity. Closely scrutinize all traffic related to PAN-OS devices. Prioritize these measures to mitigate risk while expediting patch deployment to minimize exposure to active exploitation.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
