This is our weekly roundup of Palo Alto Networks security advisories published or updated between Oct 12–18, 2026. Palo Alto Networks published or updated 14 advisories this week (2 high, 9 medium, 3 low), including 1 updated advisory.
Each entry links to the official advisory, which is the authoritative source for affected versions, fixed versions and workarounds.
Actively exploited: CISA added the following Palo Alto Networks vulnerability to its Known Exploited Vulnerabilities (KEV) catalog this week. Treat these as patch-now items.
- CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability (added 2026-10-14, federal due date 2026-10-17)
Advisories this week
| Advisory | Title | Severity (CVSS) | Affected products | Status |
|---|---|---|---|---|
| CVE-2026-0322 | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (CISA KEV) | HIGH 8.6 | Cloud NGFW, PAN-OS, Prisma Access | New |
| PAN-SA-2026-0013 | Chromium: Monthly Vulnerability Update (October 2026) | HIGH 7.7 | Prisma Browser | New |
| CVE-2026-0321 | PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services | MEDIUM 6.6 | Cloud NGFW, PAN-OS, Prisma Access | New |
| CVE-2026-0320 | PAN-OS: Authenticated Admin Command Injection Vulnerability | MEDIUM 6.1 | Cloud NGFW, PAN-OS, Prisma Access | New |
| CVE-2026-0319 | PAN-OS: Improper Input Handling Vulnerability | MEDIUM 4.9 | Cloud NGFW, PAN-OS, Prisma Access | New |
| CVE-2026-0318 | PAN-OS: Denial of Service (DoS) on Panorama | MEDIUM 4.6 | Cloud NGFW, PAN-OS, Prisma Access | New |
| CVE-2026-0315 | GlobalProtect App: Local Privilege Escalation Vulnerability on macOS | MEDIUM 5.9 | GlobalProtect App | New |
| CVE-2026-0314 | GlobalProtect App: Local Denial of Service (DoS) on Windows | MEDIUM 4.3 | GlobalProtect App | New |
| CVE-2026-0313 | Cortex XSOAR: OS Command Injection Vulnerability | MEDIUM 6.1 | Cortex XSOAR OS Query, Cortex XSIAM OS Query | New |
| CVE-2026-0312 | Checkov by Prisma Cloud: Path Traversal Vulnerabilities | MEDIUM 4.3 | Checkov by Prisma Cloud | New |
| CVE-2026-0307 | GlobalProtect App: Local Privilege Escalation Vulnerabilities | MEDIUM 5.9 | GlobalProtect App | Updated |
| CVE-2026-0317 | PAN-OS: Denial of Service Vulnerability | LOW 1.2 | Cloud NGFW, PAN-OS, Prisma Access | New |
| CVE-2026-0316 | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability | LOW 1.1 | Cloud NGFW, PAN-OS, Prisma Access | New |
| CVE-2026-0311 | Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability | LOW 1.1 | Checkov by Prisma Cloud | New |
What we recommend doing this week
- Check your exposure first. Confirm the exact PAN-OS, GlobalProtect, Panorama and Prisma Access versions you run (Dashboard > General Information, or
show system infofrom the CLI) and which features are enabled. Many advisories only apply when a specific feature, such as the GlobalProtect portal or the management web interface, is configured. - Patch in priority order. Anything on the CISA KEV list or rated critical comes first, especially on internet-facing interfaces. High-severity issues follow in your next maintenance window. Medium and low issues can usually be bundled into routine upgrades.
- Lock down the management interface. Management access should only be reachable from trusted administrative networks, never from the internet. This single control reduces the impact of many management-plane vulnerabilities.
- Use workarounds and threat signatures as a bridge, not a fix. Where an advisory lists Threat Prevention signatures or workarounds, apply them while you schedule the upgrade, then upgrade to a fixed release.
- Upgrade safely. Read the release notes, take a configuration backup, upgrade the passive member of an HA pair first and verify traffic, logging and VPNs before upgrading the active member.
Not sure whether this week’s advisories affect you? SK IT Solutions can review your PAN-OS versions and configuration against current advisories and plan the upgrade. See our Palo Alto firewall health checks or book a free consultation.
Sources: Palo Alto Networks Security Advisories and the CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.16). This summary is generated automatically from the official feeds each week. Always confirm affected and fixed versions in the official advisory before making changes.