NHS England issued alert CC-4868 on Thursday ordering organisations running Palo Alto Networks PAN-OS to patch against CVE-2026-0322 after vendors and US authorities confirmed active exploitation in the wild.
What the vulnerability allows
Palo Alto’s advisory says an authenticated attacker with network access to the management interface could execute arbitrary code with root privileges on affected firewalls. Versions from PAN-OS 10.2 through 12.2 are in scope. The flaw is particularly dangerous in health networks where perimeter appliances also segment medical devices that cannot be patched quickly.
The US Cybersecurity and Infrastructure Security Agency added the CVE to its Known Exploited Vulnerabilities catalogue, triggering federal remediation deadlines that UK defenders treat as a bellwether. NHS England’s National Cyber Security Operations Centre assesses further exploitation as highly likely, especially where management interfaces remain exposed to broader subnets against vendor guidance.
Why hospitals feel this first
Many trusts standardised on Palo Alto gear through the Secure Boundary programme, meaning a single CVE can touch hundreds of sites simultaneously. Unlike desktop endpoints, firewalls often wait for maintenance windows that do not disrupt overnight imaging batches or remote clinician VPNs. Attackers know that lag and hunt management ports during weekends.
Thursday’s alert landed beside a separate Cisco AsyncOS warning on email gateways—another choke point for phishing lures targeting payroll and vaccine supply chains. Security teams must triage both without pausing clinical systems.
Mitigations beyond patching
NHS guidance repeats Palo Alto’s recommendation to restrict management access to trusted internal IPs, disable unused interfaces, and verify that logging forwards to the national SOC. Organisations unable to patch immediately should at least block management access from the internet and enforce multi-factor authentication on admin accounts.
Broader lesson
Edge appliances are now the preferred route for ransomware crews that cannot phish clinicians fast enough. CC-4868 will not be the last firewall CVE this winter; the operational test is whether NHS England’s central monitoring can correlate exploitation attempts across trusts before patient-facing outages occur.
Coordination with national SOC
Trusts forwarding logs to the national Cyber Security Operations Centre should flag any authentication attempts against management interfaces, even failed ones. Correlation across sites has caught scanning campaigns early in previous winters.
Vendor patch cadence
Palo Alto released fixed PAN-OS builds alongside workarounds for organisations that cannot reboot firewalls during clinical hours. NHS Digital’s bulletin links to version matrices; teams must document compensating controls if they defer reboots beyond 72 hours.
Patient safety framing
Chief information officers are briefing clinical directors that delayed patches are a patient-safety issue, not an IT inconvenience, because ransomware downtime cancels elective surgery faster than flu outbreaks.
Supply chain for appliances
Smaller trusts buy managed firewall services from integrators who may patch slower than national guidance assumes. NHS England’s bulletin explicitly names managed service providers as accountable for applying vendor fixes within agreed SLAs.
Overlap with Secure Boundary
Organisations that rely on nationally managed Palo Alto estates must still verify that central change windows align with trust maintenance slots. A national patch push scheduled for Sunday night may clash with oncology systems that cannot tolerate any firewall failover during Monday morning clinics.
Historical parallels
Previous PAN-OS flaws triggered weekend war rooms across the NHS; CC-4868 is the first major firewall alert this autumn after a summer of VPN appliance issues. Security chiefs are using it as a drill to test escalation paths to NHS England’s 24-hour cyber line.