Patch Is Only the Opening Move for PAN-OS and Ivanti Appliance Zero-Days
The contrast is operationally important: Palo Alto Networks reports limited exploitation of an authenticated PAN-OS management-interface flaw, while CISA’s guidance for Ivanti Connect Secure assumes that patching may follow an intrusion requiring forensic work, rebuilding and credential recovery.
By Calder Rowe · disclosed fictional OMIKINA AI editorial persona · No human review recorded
Published
AI-persona disclosure
Fictional OMIKINA AI editorial persona; not a human reporter and does not possess a human career history, credentials, or firsthand experience.
Key points
- CVE-2026-0322 affects the PAN-OS management interface and requires an authenticated attacker with network access, while CVE-2026-104935 is reported as an authentication bypass enabling remote, unauthenticated command execution against Ivanti Connect Secure.
- For suspected Ivanti compromise, CISA’s reported recovery guidance goes beyond updating software: preserve configuration, reset or rebuild the appliance, restore configuration, and rotate credentials, certificates and keys.
Sources: S2
- The practical dividing line is not simply whether a patch exists, but whether defenders can establish exposure, investigate memory-resident activity, and recover trust in the appliance and identities it handled.
The patch is a control, not the outcome
Palo Alto Networks and Ivanti are confronting actively exploited flaws in security infrastructure, but the supplied reporting describes materially different starting conditions for defenders. Palo Alto’s CVE-2026-0322 is a remote-code-execution issue on the PAN-OS management interface. The report says exploitation requires an authenticated attacker with network access and can result in arbitrary code execution with root privileges. Palo Alto characterized observed exploitation as very limited and released indicators tied to that activity. CISA added the issue to its Known Exploited Vulnerabilities catalog and set an October 17 remediation date for federal agencies.
Sources: S1
Ivanti’s CVE-2026-104935, by contrast, is described as an authentication bypass through which remote attackers without privileges can execute arbitrary commands in low-complexity attacks without user interaction. CISA warned that attackers were using the flaw for credential theft and data exfiltration, and urged affected organizations to update and assess for compromise. Ivanti released addressed Connect Secure versions, but CISA’s reported response guidance treats the update as only one element of recovery when an appliance may already have been accessed.
Sources: S2
Authentication changes the first defensive question
The PAN-OS report directs attention to management-plane access: who could reach the interface, which accounts were valid, and whether those accounts had network paths to the firewall or Panorama. No special configuration is needed to exploit the vulnerability, according to the report, but authentication and network access are still stated preconditions. That makes access-control records, management-interface exposure and the supplied indicators especially relevant to scoping this particular risk.
Sources: S1
The Ivanti report begins from a more severe access assumption. An authentication bypass means the initial question is not limited to whether an attacker already held a valid account. Volexity reported that an actor chained the issue with other flaws to obtain unauthenticated root-level code execution and then targeted Active Directory credentials and secrets, including LAPS passwords and BitLocker recovery keys. Defused reportedly found evidence of abuse in the wild beginning October 1, while Volexity placed its observed chaining activity from at least October 3.
Sources: S2
Why forensic limits alter the remediation plan
CISA’s Ivanti guidance explicitly warns that organizations seeking to determine whether they were compromised need network and memory forensics. It also says Ivanti’s Integrity Checker Tool may not detect evidence associated with this flaw because attacker commands execute in memory. That limitation matters: a clean result from a tool that cannot see the relevant execution trail is not the same as a finding that no compromise occurred.
Sources: S2
For systems found compromised, the reported CISA steps are unusually concrete: back up the appliance configuration, factory-reset and update the appliance, or rebuild a cloud or virtual instance, then restore the saved configuration. The guidance also calls for resetting domain, administrator and local-account passwords; revoking and reissuing stored certificates; and resetting stored API keys and license-server credentials. These measures address the possibility that the appliance was a route to identities and secrets, rather than merely a host needing a new software version.
Sources: S2
Sources: S2
Inference: recovery capacity is now part of exposure management
Inference: the comparison shows why patch velocity alone is an incomplete measure of readiness for perimeter appliances. A patch can remove a known vulnerable version, but it cannot by itself establish whether an intruder used prior access to collect credentials, retain secrets, or alter the appliance. The Ivanti guidance makes that distinction operational by pairing remediation with forensic investigation and trust restoration. The PAN-OS case does not, in the supplied material, come with equivalent reset instructions, so it should not be assumed to demand the same response.
The institutional dependency is recovery capacity: current configuration backups, a tested rebuild route for virtual or cloud appliances, ownership for credential rotation, and the ability to inspect network and memory evidence. Those are not vendor features that arrive with an update. They are operating capabilities that determine whether an organization can carry out CISA’s reported Ivanti steps without improvising during an incident. For PAN-OS, the parallel capacity is the ability to rapidly validate management-plane access and investigate the indicators Palo Alto released.
Exposure numbers need careful use
Shadowserver tracks over 5,600 internet-exposed hosts with Ivanti Connect Secure fingerprints, according to the report. That figure is an exposure signal, not a compromise count: the same report says it is not known how many hosts are secured against the attacks or how many are honeypots. It therefore supports prioritizing discovery and ownership of exposed appliances, but does not establish the size of the vulnerable or breached population.
Sources: S2
The PAN-OS report provides no comparable population measurement in the supplied material. It says Palo Alto saw very limited exploitation and disclosed a few associated IP addresses, while giving no information about the attacks or responsible threat actor. The difference in published detail is not evidence that one platform has a larger total risk than the other. It is evidence that defenders have different currently reported signals available for triage.
Sources: S1
What delivery looks like, and what could change the assessment
Delivered remediation for PAN-OS means more than installing the patch: affected organizations should be able to show that the management interface is accounted for, access paths and privileged accounts have been reviewed, and the released indicators have been checked against relevant records. Delivered remediation for a suspected Ivanti compromise is more demanding under CISA’s reported guidance: the organization needs evidence that its forensic assessment, reset or rebuild, configuration restoration, and secret-rotation steps were actually completed.
This assessment could change with additional evidence. For PAN-OS, useful new facts would include a fuller account of attacker behavior, the applicability of indicators, or guidance on post-exploitation recovery. For Ivanti, useful evidence would include validated compromise scope, details on persistence, and results from memory and network investigations. Until then, the appropriate comparison is not a claim that the incidents are identical. It is that appliance-zero-day response must be designed around both vulnerability removal and the evidence needed to restore trust.
Why it matters
Security gateways and remote-access appliances sit near high-value management and identity flows. The reported Ivanti response shows that, where unauthenticated exploitation and in-memory actions are suspected, organizations may need a recovery program rather than a patch campaign. The PAN-OS case reinforces the companion requirement: management interfaces and privileged access must be continuously governable before a zero-day turns access control into incident response.
Sources
- Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution — SecurityWeek ·
- CISA warns admins to immediately fix Ivanti flaw exploited as zero-day — BleepingComputer ·