Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.
CVE-2026-0322: PAN-OS Authenticated RCE
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-10-14. Federal agencies must patch by 2026-10-17.
Everything CISA added on 2026-10-14 · Palo Alto Networks KEV history
TL;DR - CVE-2026-0322 is an authenticated PAN-OS management-interface code-injection vulnerability enabling root-level code execution. - PA-Series, VM-Series, and Panorama systems on affected branches require branch-specific upgrades. - Exploitation is confirmed and the CVE is in CISA KEV; patch urgently and restrict management access.
CVE-2026-0322 is a high-priority PAN-OS vulnerability affecting the management interface of Palo Alto Networks PA-Series and VM-Series firewalls and Panorama appliances. An authenticated attacker with network access and high privileges can potentially execute code as root. Palo Alto Networks reports limited exploitation, and CISA lists the vulnerability in its Known Exploited Vulnerabilities catalog.
Organizations reviewing broader firewall exposure may also benefit from this guide to zero-trust architecture, particularly when restricting administrative interfaces to trusted sources.
Are You Affected?
CVE-2026-0322 affects PAN-OS deployments where an attacker has valid credentials, network access to the management interface, and access to an affected software branch. The vulnerability is not described as an unauthenticated attack against ordinary traffic-processing interfaces. An Internet-exposed or broadly reachable management interface substantially increases the practical attack surface.
| Field | Details |
|---|---|
| CVE | CVE-2026-0322 |
| Vendor | Palo Alto Networks |
| Product | PAN-OS |
| Vulnerability | CWE-94, improper control of code generation / code injection |
| NVD CVSS | 7.2, CVSS v3 |
| Vendor CVSS | 8.5, CVSS v4.0 base-threat |
| Attack vector | Adjacent network (AV:A in the vendor CVSS v4 vector) |
| Authentication / privileges | Authenticated attacker; high privileges required (PR:H) |
| User interaction | None required |
| Patch available | Yes |
| Exploitation status | Confirmed in the wild; listed in CISA KEV |
| Public PoC | No verified public PoC identified in the reviewed sources |
The affected platforms are PA-Series firewalls, VM-Series firewalls, Panorama virtual appliances, and Panorama M-Series appliances. Palo Alto Networks identifies Cloud NGFW and Prisma Access as not impacted. The affected-version information below reflects the vendor’s branch-specific remediation guidance:
| PAN-OS branch | Affected releases | Fixed release |
|---|---|---|
| 10.2 | Versions prior to 10.2.18-H12, including reported affected releases such as 10.2.7-H38, 10.2.10-H41, 10.2.13-H26, and 10.2.16-H11 | 10.2.18-H12 or later |
| 11.1 | Reported affected releases include 11.1.4-H37, 11.1.6-H39, 11.1.7-H11, 11.1.10-H35, 11.1.13-H15, and 11.1.16-H3 | 11.1.16-H3 or later |
| 11.2 | Versions prior to 11.2.16, including affected 11.2.14 and 11.2.15 releases | 11.2.16 or later |
| 12.1 | Versions before the applicable fixes, including releases before 12.1.4-H12, 12.1.7-H8, and 12.1.10-H2 | 12.1.4-H12, 12.1.7-H8, or 12.1.10-H2, depending on branch |
| 12.2 | Versions prior to 12.2.4 | 12.2.4 or later |
Because PAN-OS remediation is branch-specific, do not select a target solely because its numeric version appears newer. Confirm the supported upgrade path and exact hotfix in the Palo Alto Networks advisory for the installed platform and release.
Analyst’s Take: Treat this as an access-control and patching problem at the same time. Authentication requirements narrow the entry path, but confirmed exploitation and root-level impact make an exposed management interface a priority even when it is reachable only from internal networks.
The Fix, If You’re in a Hurry
Upgrade each affected device to the applicable fixed version:
- PAN-OS 10.2:
10.2.18-H12or later - PAN-OS 11.1:
11.1.16-H3or later - PAN-OS 11.2:
11.2.16or later - PAN-OS 12.1:
12.1.4-H12,12.1.7-H8, or12.1.10-H2, according to the installed maintenance branch - PAN-OS 12.2:
12.2.4or later
Use Panorama and the PAN-OS software-management workflow appropriate to your deployment. A generic operational sequence is to verify the current release, review available software, download the approved target, install it during a controlled maintenance window, and confirm the device returns to service with the expected configuration and HA state.
Technical Notes: Upgrade and containment
On PAN-OS, administrators can verify the running release from the CLI with:
show system info
The output includes the installed sw-version. Download and installation syntax can vary by PAN-OS release and management method, so administrators should use the documented Palo Alto Networks upgrade procedure rather than applying an unverified CLI command. Install the fixed release matching the device’s branch, then verify the version again after reboot.
Until the upgrade is complete, restrict management-plane access to known administrative sources or a dedicated jump host. Remove direct Internet exposure where feasible and review permitted management services and source addresses. For example, an access policy should allow HTTPS and SSH management only from approved administration networks, not from broad or unrestricted address ranges. This is a compensating control, not a replacement for patching.
If compromise is suspected, preserve logs and configuration snapshots before making extensive changes where operationally possible. Rotate affected administrator credentials, investigate newly created accounts and unexplained configuration changes, and coordinate with Palo Alto Networks or incident-response personnel before returning a potentially compromised firewall to normal service.
Organizations using password managers should also audit privileged administrator credentials and access policies. A solution such as Try 1Password → may help centralize credential controls, but it does not replace vendor patching, phishing-resistant authentication, or network restrictions.
How This Vulnerability Works
Palo Alto Networks describes CVE-2026-0322 as a remote code execution vulnerability in the PAN-OS management interface. An authenticated attacker with network access can submit attacker-influenced input that is processed in an unsafe code-generation or code-execution path. The vendor classifies the weakness as CWE-94, improper control of code generation, commonly referred to as code injection.
The exploit prerequisites are specific: valid credentials or equivalent authenticated access, network reachability to the management interface, and a vulnerable PAN-OS deployment. The vendor’s CVSS v4 vector rates privileges required as high, but successful exploitation does not require user interaction. Controls around administrator credentials, management-interface exposure, and authentication logging therefore remain central to reducing risk.
Successful exploitation can provide arbitrary code execution with root privileges on the firewall or Panorama appliance. Root-level access could enable an attacker to alter security policy, tamper with device configuration, access secrets, interfere with traffic handling, establish persistence, or use the device to reach other systems. Those outcomes are technically possible consequences of device compromise; defenders should not claim that any particular post-exploitation activity occurred without supporting forensic evidence.
Severity, Explained
The NVD record reports a CVSS v3 base score of 7.2, but the supplied NVD data does not include the corresponding CVSS v3 vector. The score should therefore be treated as a severity indicator rather than a complete explanation of the v3 scoring components.
Palo Alto Networks provides a CVSS v4.0 base-threat score of 8.5 with this vector:
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red
The major operational implications are:
| Component | Meaning |
|---|---|
AV:A |
The attack requires adjacent-network access to the management interface. |
AC:L |
No unusual attack complexity is identified. |
AT:N |
No additional special condition is required beyond the stated prerequisites. |
PR:H |
High privileges or authenticated administrative access are required. |
UI:N |
No separate victim interaction is required. |
VC:H/VI:H/VA:H |
Confidentiality, integrity, and availability of the vulnerable system can be severely affected. |
SC:N/SI:N/SA:N |
The scoring describes impact on the vulnerable system rather than directly scoring downstream systems. |
E:A |
Exploitation is known to be active or available for threat activity, consistent with the observed exploitation and KEV listing. |
Do not interpret the score as low risk merely because authentication is required. Management interfaces often have powerful privileges, are reused across many devices, and may be exposed through remote administration infrastructure. Root-level impact and confirmed exploitation make this a priority even for organizations whose exposure is limited to internal networks.
Is It Being Exploited?
Yes. Exploitation is confirmed in the wild. Palo Alto Networks reports that very limited exploitation has been observed against the PAN-OS management interface. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on October 14, 2026, with a federal remediation deadline of October 17, 2026.
CISA KEV inclusion is an authoritative indication that exploitation has occurred in real-world conditions. CISA lists known ransomware campaign use as unknown. That status does not mean ransomware was involved; it means CISA has not confirmed or classified the vulnerability as being used in a known ransomware campaign.
Palo Alto Networks identified the following threat-activity IP addresses in its advisory:
66[.]42[.]72[.]14
208[.]83[.]239[.]114
149[.]248[.]47[.]234
These indicators are not a complete detection set. Correlate them with authentication events, management-interface requests, administrator activity, configuration changes, process execution, and outbound network connections.
No verified public CVE-2026-0322 proof-of-concept repository was identified in the reviewed research. A lack of public exploit code is not a safety signal: the vulnerability is already being exploited, and access to legitimate administrative credentials may be more important to an attacker than a broadly published PoC.
Detecting It in Your Environment
Start by inventorying every PA-Series firewall, VM-Series firewall, Panorama virtual appliance, and Panorama M-Series appliance. Record the PAN-OS version, management-interface exposure, permitted source networks, administrator accounts, authentication method, and recent upgrade history. Devices on affected branches should be treated as exposed until their versions are verified against the vendor’s fixed-release matrix.
Review management-plane authentication and administrative activity for unusual source addresses, unexpected login times, repeated failures followed by success, new administrator accounts, privilege changes, configuration commits, and changes to management access rules. Also inspect outbound connections from the firewall or Panorama appliance and any signs that the device initiated connections inconsistent with its normal administrative or telemetry behavior.
Technical Notes: Log patterns and queries
The exact field names vary by PAN-OS logging format and SIEM integration. A starting-point query should search for the vendor-reported indicators across management, authentication, system, configuration, and network telemetry:
(source_ip IN ("66.42.72.14", "208.83.239.114", "149.248.47.234")
OR destination_ip IN ("66.42.72.14", "208.83.239.114", "149.248.47.234"))
Search normalized logs for management activity with patterns such as:
(action IN ("login", "admin-login", "config-commit", "create-admin", "change-admin")
AND (src_ip NOT IN approved_management_ranges
OR user NOT IN approved_admin_accounts))
For raw or semi-structured logs, useful strings to investigate include:
"authentication failure"
"authentication success"
"admin login"
"configuration committed"
"administrator created"
"management access"
"command execution"
These are detection pivots, not vendor-confirmed exploit signatures. A successful login from an unexpected source is not proof of CVE-2026-0322 exploitation, and the absence of a matching IP address does not clear a device. Attackers may use compromised legitimate accounts, alternate infrastructure, or a source address not included in the advisory.
Preserve relevant logs with timestamps, device identifiers, source addresses, usernames, authentication results, configuration diffs, and outbound connection records. Compare the current configuration with known-good snapshots, paying particular attention to administrator accounts, management access controls, security policies, routing, NAT, scheduled tasks, certificates, API keys, and external service integrations.
Incident-Response Checklist
If a potentially affected device shows suspicious activity:
- Restrict management access to a known administrative network or jump host.
- Preserve authentication, system, configuration, and network logs.
- Export or snapshot the current configuration and record the running PAN-OS version.
- Review administrator accounts, privilege changes, configuration commits, and management-plane access rules.
- Rotate administrator credentials and revoke exposed tokens or API keys.
- Compare the device configuration with a known-good baseline.
- Investigate unexpected outbound connections and changes to routing, NAT, security policy, certificates, or scheduled activity.
- Coordinate with Palo Alto Networks and qualified incident responders before rebuilding or returning the device to service.
- Upgrade to the applicable fixed release after evidence-preservation requirements are addressed.
- Document remediation, validation steps, and any residual monitoring requirements.
Do not assume that upgrading alone proves a device was not compromised. Patch validation and incident investigation are separate activities.
References and Further Reading
The Palo Alto Networks security advisory is the primary source for affected versions, fixed releases, exploitation details, and product-specific mitigation guidance:
CISA’s Known Exploited Vulnerabilities catalog provides the exploitation status, catalog date, remediation deadline, and applicable federal guidance:
The NVD record provides the CVE publication record and the reported CVSS v3 score:
Additional technical and vulnerability-database context is available from:
Use the Palo Alto Networks advisory to select the final target version. After upgrading, verify the installed PAN-OS version, confirm management access remains restricted, review authentication and configuration logs, and retain evidence of remediation for asset and compliance records.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.