CVE-2026-0322 – High Authenticated Remote Code Execution in Palo Alto Networks PAN-OS Management Interface
TL;DR
- CVE-2026-0322 is a High severity remote code execution flaw in the management interface of Palo Alto Networks PAN-OS.
- An authenticated attacker with network access can execute arbitrary code with root privileges.
- The vulnerability is listed in the CISA KEV, indicating known exploitation.
- Affects PA-Series, VM-Series firewalls, and Panorama; not impacted: Cloud NGFW, Prisma Access.
- Immediate action: apply the vendor patch or restrict management interface access to trusted hosts.
Overview
CVE-2026-0322 is an authenticated remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS. The flaw allows an attacker who has valid credentials and network access to the management service to run arbitrary code with root privileges on the firewall. The bug has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.
Technical Details
- CWE: CWE-94 – Improper Control of Generation of Code (Code Injection)
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: High (PR:H) – attacker must be authenticated
- User Interaction: None (UI:N)
- Impact: Confidentiality, Integrity, Availability all set to High (C:H/I:H/A:H)
- Exploit Maturity: Attacked – real‑world exploitation observed
The vulnerability resides in the PAN‑OS management interface. Successful exploitation yields a root shell on the device, enabling full compromise of the firewall and any traffic it controls.
Severity & Impact
| Metric | Value |
|---|---|
| CVSS 4.0 | 8.6 HIGH |
| CVSS 3.1 | 7.2 HIGH |
| CISA KEV | Added 2026‑10‑14 |
The combination of high privileges required and the presence of active exploitation makes this a priority for defenders. Even though authentication is needed, any credential with sufficient rights (e.g., admin accounts) can be leveraged.
Affected Products
- Palo Alto Networks PA‑Series physical firewalls
- VM‑Series virtual firewalls
- Panorama (virtual and M‑Series)
Not impacted: Cloud NGFW and Prisma® Access.
For the complete list of affected versions, see the CVE page.
Actionable Insights / What to Do
- Verify exposure – Identify all PAN‑OS instances where the management interface is reachable from the network. Use the VulnSocial CVE page for real‑time threat activity and indicators of compromise.
- Restrict access – Enforce the vendor’s recommended best practice: limit management interface access to trusted internal IP addresses (e.g., via a jump host).
- Monitor logs – Watch for authentication anomalies, unexpected admin logins, or any outbound connections from the firewall that could indicate post‑exploitation.
- Apply patch – Deploy the fixed PAN‑OS release as soon as possible (see Remediation steps).
- Hunt for IoCs – The vendor shared three IP addresses associated with limited exploit attempts; treat them as unconfirmed until validated in your own telemetry.
Remediation & Mitigation
- Upgrade to a fixed PAN‑OS version that resolves CVE-2026-0322. Refer to the vendor advisory for branch‑specific hotfixes or upgrade paths.
- If immediate upgrade is not possible, disable the management interface on external interfaces and restrict HTTP/HTTPS management to a dedicated VLAN with strict firewall rules.
- Enable multi‑factor authentication for all administrative accounts to reduce the risk of credential theft.
- Deploy Threat Prevention signatures 510046 and 510047 (content version 9159‑10287+) as an additional layer of detection when management traffic is decrypted; note these do not replace the need to patch.
- Validate that the fix is applied by checking the PAN‑OS version and confirming no vulnerable management services are listening.
Bottom Line
CVE-2026-0322 is a High severity, actively exploited RCE in Palo Alto Networks PAN-OS. Defenders should prioritize patching or isolating the management interface, and monitor for signs of compromise. For ongoing threat intelligence, see the CVE page.
References
#CVE20260322 #PANOS #RCE #CISA_KEV #High #PaloAltoNetworks