PAN-OS Management Interface RCE Exploited (CVE-2026-0322)

At a glance

Severity	CRITICAL
CVSS	CVE-2026-0322: 8.6
In CISA KEV (exploited)	Yes, due 2026-10-17
Vendor	Palo Alto Networks
CVE IDs	CVE-2026-0322

Palo Alto Networks has disclosed CVE-2026-0322, a code injection flaw in the PAN-OS management interface that lets an authenticated attacker with network access run arbitrary code as root on the firewall. The vendor rates exploit maturity as attacked and says very limited exploitation has been observed, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 14 October 2026 with a federal due date of 17 October 2026. Details come from the Palo Alto Networks advisory.

What happened

The advisory describes a remote code execution weakness in the management interface of PAN-OS (CWE-94, improper control of generation of code). An attacker who already has high privileges on the interface can use it to execute code with root privileges on the device. Palo Alto Networks says it discovered the issue internally.

The advisory scores the flaw 8.6 (High) under CVSS 4.0, with a network attack vector, low complexity, no user interaction and high impact on confidentiality, integrity and availability. It also gives a lower 8.5 score for deployments where access is limited to an adjacent network, for example through a jump box.

Am I affected?

The issue applies to PAN-OS on PA-Series and VM-Series firewalls and on Panorama, both virtual and M-Series. No special configuration is needed to be exposed. Cloud NGFW and Prisma Access are not impacted.

According to the advisory, affected branches and the first fixed releases include:

PAN-OS 12.2: versions before 12.2.4 are affected.
PAN-OS 12.1: fixes in 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2, depending on your maintenance train.
PAN-OS 11.2: fixes in 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 and 11.2.16. The advisory lists 11.2.16 with an ETA of 15 October.
PAN-OS 11.1: fixes in 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3.
PAN-OS 10.2: fixes in 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 and 10.2.18-h12.

Use the vendor advisory to match your exact version to the right fixed release, because the branch tables differ. The NVD record does not list affected products yet.

Technical details

Weakness: CWE-94 code injection, reachable through the management interface.
Privileges required: high. The attacker must be authenticated.
Exploitation: the vendor reports very limited exploitation against the management interface. Which actors are behind it, and how they obtained credentials, has not been disclosed.
CISA KEV: added 14 October 2026, due 17 October 2026. Known ransomware campaign use is listed as Unknown.
EPSS: not available in the data we have.

CISA’s required action tells organisations to apply vendor mitigations in line with BOD 26-04 and its forensics triage requirements, and to discontinue use of the product if mitigations are unavailable.

Why this matters

Analysis: the authentication requirement lowers the odds for a well-isolated firewall, but it is not a safe harbour. Management interfaces are high-value targets, and a root shell on a perimeter firewall gives an attacker a path to traffic, credentials and the network behind it. The vendor itself says risk is highest when the interface is reachable from the internet. Any device in that state, or with weak or shared admin credentials, should be treated as the top patching priority. Because the flaw is in KEV, patch within hours rather than waiting for a regular maintenance window.

What to do

Find every PA-Series, VM-Series and Panorama system and record its PAN-OS version.
Check whether the management interface is reachable from the internet or from broad internal ranges. Restrict it to trusted internal addresses now, ideally behind a single jump box, as the vendor recommends.
Upgrade to the fixed release for your branch from the advisory. If your fix is not yet released, such as 11.2.16, apply the restriction and upgrade as soon as it ships.
Rotate administrator credentials and review the admin account list for entries you do not recognise.
Hunt for compromise: review management interface access logs and configuration change history for unexpected logins, unfamiliar source addresses and changes you did not make, going back before the 14 October disclosure. The advisory does not publish indicators of compromise.
If you find signs of compromise, follow CISA’s forensics triage guidance and your incident response plan before rebuilding.

Bottom line

Treat this as an actively exploited flaw. Lock down management access first, since that works today, then move to the fixed release for your branch before the 17 October deadline. Primary references: the NVD entry and the vendor advisory above.

Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.

Related coverage

Sources

Spotted an error or outdated detail? Email contact@cyberstrikenews.com with the article link. We correct and note every change. Read our Editorial Policy.