Palo Alto Networks has fixed CVE-2026-0322, a remote code execution flaw in the PAN-OS management interface. An attacker who already has valid credentials and network access to the management interface can run arbitrary code as root on the firewall. The vendor says: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14, with a due date of 2026-10-17 for US federal agencies. The flaw affects PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not affected. There are no workarounds, but fixed releases are available for every supported branch (Palo Alto Networks advisory).
Technical Information
- Vulnerability: authenticated RCE in the PAN-OS management interface (CWE-94, code injection). Palo Alto says "No special configuration is required to be affected." Risk is highest when the management interface can be reached from the internet.
- Authentication required: yes. The CVSS vector requires high privileges (PR:H). This is not an unauthenticated bug, but it does turn a stolen or misused admin login into root on the firewall.
- Severity:
- Palo Alto: CVSS 4.0 8.6 HIGH, Suggested Urgency HIGHEST, exploit maturity "Attacked". The score drops to 8.5 when management access is limited to a jump box.
- NVD: CVSS 3.1 7.2 HIGH.
- Discovery: found internally at Palo Alto Networks.
- Timeline (IDT):
- 14 Oct, 19:00: advisory published. CISA adds the CVE to KEV the same day.
- 15 Oct: the advisory is updated to say the PAN-OS 11.2.16 fix is out.
- 17 Oct: KEV due date.
- What is not known: Palo Alto has not said when exploitation began, who is behind it, or whether attackers used compromised firewalls to reach internal networks. BleepingComputer asked these questions and has not reported an answer. CISA lists known ransomware campaign use as "Unknown".
- KEV entry: "Palo Alto Networks PAN-OS Code Injection Vulnerability", dateAdded 2026-10-14, dueDate 2026-10-17, forensicTriage Yes.
Affected Product Versions
| Branch | Affected | Fixed in |
|---|---|---|
| PAN-OS 12.2 | earlier than 12.2.4 | 12.2.4 |
| PAN-OS 12.1 | earlier than 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 | 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2 |
| PAN-OS 11.2 | earlier than 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16 | the matching hotfix or 11.2.16 |
| PAN-OS 11.1 | earlier than 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3 | the matching hotfix or 11.1.16-h3 |
| PAN-OS 10.2 | earlier than 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12 | the matching hotfix or 10.2.18-h12 |
| Older unsupported PAN-OS | not listed in the vendor's status table | upgrade to a supported fixed release (vendor guidance) |
| Cloud NGFW, Prisma Access | not affected | no action needed |
The advisory includes this vulnerability on PA-Series, VM-Series and Panorama (virtual and M-Series). Use the vendor's per-minor-version upgrade table to choose your exact target build.
Workaround and Mitigation
- Upgrade to a fixed release. Palo Alto says there are no known workarounds.
- Lock down the management interface. Allow access only from trusted internal IP addresses or a dedicated jump box, following Palo Alto's best-practice guidance. This is the main way to reduce the risk.
- Threat Prevention gives limited coverage. Threat IDs 510046 and 510047 (content version 9159-10287 and later) only help if all of the following are true: management traffic is routed through a data-plane interface; the inbound management certificate has been replaced; inbound management traffic is decrypted; and threat prevention is enabled on that traffic. Palo Alto warns that variations may not be detected, and still recommends upgrading.
- Check for misuse (Rescana guidance, not a Palo Alto Networks recommendation). Because exploiting this flaw requires valid credentials, Rescana recommends reviewing admin logins and configuration changes on the management plane, and considering rotating admin credentials and enforcing MFA.
Indicators of Compromise
Palo Alto lists three IP addresses "associated with threat activity and limited exploit attempts targeting this vulnerability". Validate them before blocking:
- 66[.]42[.]72[.]14
- 208[.]83[.]239[.]114
- 149[.]248[.]47[.]234
No hashes, domains or threat actor names have been published. No MITRE ATT&CK mapping is published.
Sources
- Palo Alto Networks security advisory CVE-2026-0322
- BleepingComputer: Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
- NVD entry for CVE-2026-0322
What This Means for Your Third-Party Risk Program
A supplier can patch its firewall's traffic path and still leave the management interface reachable. Because this flaw needs valid admin credentials, the real question for a vendor is both its patch level and who can reach and log in to firewall management. A fast but accurate review starts by confirming which vendors and MSPs actually run PAN-OS firewalls or Panorama in front of your data. Then ask them:
- Which PAN-OS or Panorama version are you running, and is it at or above the fixed hotfix for your branch?
- Can the management interface be reached from the internet, or only from a jump box or trusted IPs?
- Have you reviewed admin logins and configuration changes since early October, including for the three IPs Palo Alto published?
- Are firewall admin accounts protected by MFA?
Forward this to your TPRM owner: PAN-OS CVE-2026-0322 is an authenticated root-level RCE in the firewall management interface. It is exploited, in CISA KEV, with a CISA due date of 17 October. Please check which vendors run PAN-OS or Panorama and send them the four questions above.
If you'd like help working out which of your vendors expose PAN-OS or Panorama management interfaces, book a demo.
