PAN-OS

Critical Code Injection Flaw in Okta Access Gateway Allows Authenticated Command Execution

Okta disclosed CVE-2026-115547, a critical code injection vulnerability in the administrative console of Okta Access Gateway. An authenticated administrator can execute arbitrary commands on the underlying system using the privileges of the gateway service account. The flaw received a CVSS 3.1 score of 9.1 and stems from insufficient input validation when processing configuration values in a specific format. Affected appliances running versions prior to 2026.10.2 must be updated, as no workaround is provided. The same disclosure day also included CVE-2026-115546 for authentication source verification and two PHP execution issues (CVE-2026-109618, CVE-2026-109619) previously seen in Palo Alto PAN-OS. Exploitation requires administrative console access and no in-the-wild attacks have been reported.

Palo Alto Networks Discloses Seven PAN-OS Vulnerabilities Including One Already Exploited in the Wild

Palo Alto Networks has published seven security advisories addressing vulnerabilities in its PAN-OS operating system used on PA-series and VM-series firewalls as well as the Panorama management platform. One flaw tracked as CVE-2026-0322 allows authenticated remote code execution with root privileges through the management interface and has already been observed in limited exploitation attempts. The company rated the issue with a CVSS v4.0 base score of 8.6 and assigned it the highest remediation priority. Four additional medium-severity issues and two low-severity issues were also fixed in the same set of advisories. Products such as Cloud NGFW and Prisma Access are confirmed to be unaffected. Palo Alto Networks urges immediate patching for all impacted PAN-OS deployments.

Qilin Ransomware Operators Exploit Palo Alto PAN-OS VPN Flaw CVE-2026-0257

Operators linked to the Qilin ransomware group have been actively exploiting an authentication bypass vulnerability in Palo Alto Networks PAN-OS to gain initial access to corporate networks. The attacks, observed in June 2026, targeted the GlobalProtect VPN service running on Palo Alto firewalls and were tracked under CVE-2026-0257. Attackers used specially crafted authentication cookies to establish unauthorized VPN sessions, after which they harvested credentials from Windows LSASS processes and Active Directory NTDS databases. Lateral movement relied heavily on PsExec and administrative shares, supplemented by tools such as AnyDesk, Ngrok, LogMeIn, and NetExec. Before deploying the ransomware binary stored as win.exe in C:\PerfLogs\, the threat actors disabled Microsoft Defender real-time protection and cleared event logs. The vulnerability affects PAN-OS versions 10.2, 11.1, 11.2, and 12.1 as well as certain Prisma Access editions, while Panorama and Cloud NGFW remain unaffected.