PANW · News · 20261030N

PAN-OS Vulnerability Regulatory Risk

Palo Alto Networks Inc · 2026-10-30 · Importance null · Surprise null

A suspected China-linked actor chained PHP2Shell vulnerabilities with the Fragnesia Linux kernel privilege-escalation bug to gain root access to 25 Palo Alto Networks PAN-OS firewalls and management servers, including systems linked to the U.S. government. The campaign began on October 8, 2026, and targeted entities in the U.S., Japan, Taiwan, and South Korea, with directory enumeration and credential theft reported. CISA added the exploited vulnerabilities to its Known Exploited Vulnerabilities catalog; Palo Alto Networks issued patches and advised customers to restrict management-interface access to trusted IP addresses.

Key facts

• CISA added the vulnerabilities exploited in attacks on Palo Alto Networks firewalls to its Known Exploited Vulnerabilities catalog. source