Palo Alto PAN-OS CVE-2026-0984: Remote Code Execution Under Active Exploitation
Palo Alto Networks confirmed active exploitation of CVE-2026-0984, a critical remote code execution vulnerability in PAN-OS management interfaces. Threat actors are using this to deploy backdoors and pivot into internal networks. CVSS score: 9.3.
What Happened
Palo Alto Networks Unit 42 confirmed on April 8, 2026 that CVE-2026-0984, a critical remote code execution vulnerability in PAN-OS, is being actively exploited in the wild. The vulnerability exists in the web-based management interface of Palo Alto Networks Next-Generation Firewalls and Panorama management servers. An unauthenticated attacker with network access to the management interface can exploit this vulnerability to execute arbitrary code with root privileges on the affected device.
Exploitation Activity
Unit 42 has observed multiple threat actor groups exploiting this vulnerability, including a suspected nation-state group and at least two ransomware affiliate operations. Attackers are using the vulnerability to deploy persistent backdoors that survive reboots and firmware updates, create hidden administrator accounts, and use the compromised firewall as a launching point for attacks against internal network resources. In several confirmed incidents, attackers used the compromised firewall to intercept VPN credentials and gain access to internal systems.
Remediation Steps
Palo Alto Networks has released hotfixes for all affected PAN-OS versions. Apply the hotfix immediately. If you cannot patch immediately, restrict access to the management interface to trusted IP addresses using Palo Alto's management interface access restrictions. Do not expose the management interface to the internet under any circumstances. After patching, review your administrator account list, check for unauthorized configuration changes, and review your logs for signs of prior exploitation. Palo Alto has published an Indicators of Compromise (IoC) list that you can use to check your logs.
- Apply Palo Alto's hotfix immediately — do not wait for your next maintenance window
- Restrict management interface access to trusted IP addresses only
- Check for unauthorized configuration changes and new administrator accounts
- Review firewall logs for lateral movement indicators
- Contact Segler.Net if you need emergency patching assistance
Need Help With This Threat?
Our San Antonio security team can assess your exposure, apply patches, and protect your business before attackers strike.
Stay ahead of the next threat
Get weekly security alerts — breaches, patch updates, compliance news, and threat intel — delivered free to your inbox every week.