CVE-2026-0322

What is Palo Alto Networks PAN-OS?

PAN-OS is the operating system that runs Palo Alto Networks next-generation firewalls, covering the PA-Series hardware appliances, the VM-Series virtual firewalls, and Panorama, the centralised management platform for both. It enforces segmentation policy, terminates VPN tunnels, decrypts and inspects traffic, and in most enterprises is the device that defines what "inside" means.

The management interface is the control plane for all of that. An attacker who executes code as root there does not merely own one host: they can rewrite security policy, read decrypted traffic, extract stored credentials and certificates, and, where Panorama is involved, push changes to every firewall it manages. That combination of privilege and reach is why PAN-OS management-interface flaws are exploited so consistently, and why Palo Alto Networks' standing guidance is that the interface should never be reachable from the internet.

Overview

CVE-2026-0322 is a code injection vulnerability in the PAN-OS management interface that allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Palo Alto Networks rates it 8.6 High under CVSS 4.0 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red) and assigns its highest urgency rating, Red. NVD had not yet published a CVSS base score at the time of writing, which is why no severity is shown above; VulDB independently scores the issue 9.9, so published figures currently disagree by more than a point.

Palo Alto Networks published the advisory on 2026-10-14 and set exploit maturity to ATTACKED, stating that "very limited exploitation has been observed targeting the Palo Alto Networks management interface." CISA added the CVE to the KEV catalog the same day in a batch of four. It is worth reading the vendor's wording precisely: very limited observed exploitation is a narrower claim than a broad campaign, and no victim count, intrusion set, or first-observed date has been published.

The authentication requirement is the one piece of good news, and it is a weaker control than it sounds. The CVSS vector specifies PR:H, meaning high privileges are needed, so this is not a pre-auth flaw. But a firewall administrator account is exactly what credential-stuffing, phishing, and prior-breach credential reuse produce, and an authenticated administrator who was never supposed to reach a shell gains root on the appliance here. Critically, the advisory states that "no special configuration is required to be affected by this issue": unlike the Cisco AMP flaw listed in the same KEV batch, there is no feature to check, so every unpatched appliance on an affected branch is in scope.

Affected Versions

PA-Series and VM-Series firewalls and Panorama, both virtual and M-Series, are all affected. The hotfix builds listed in the right-hand column exist so that organisations can stay on a maintenance line rather than jump branches; check the vendor advisory for the exact build matching your current version, because the per-line mapping is more granular than this summary.

Technical Details

The CWE is CWE-94, improper control of generation of code, usually called code injection. The application builds something that is later evaluated or executed, and attacker-supplied input ends up inside it rather than being treated as inert data. Palo Alto Networks also maps the issue to CAPEC-242, Code Injection. The vendor has not published the vulnerable parameter, endpoint, or component within the management interface, so the precise injection point is not publicly known; that detail is being withheld while patches roll out.

The attack characteristics are legible from the CVSS 4.0 vector even without the root-cause specifics. Attack vector is Network and attack complexity is Low, with no attack requirements and no user interaction, so there is no race, no timing window, and nothing a victim has to click. Privileges Required is High: the attacker must already hold a privileged management account. Confidentiality, integrity, and availability impacts are all High on the vulnerable system, and all None on subsequent systems, which is why the score lands at 8.6 rather than higher despite yielding root.

In practice this is a privilege boundary failure rather than a perimeter failure. PAN-OS is meant to confine an administrator to its own management plane, CLI, and web interface; this flaw lets that administrator break out to arbitrary code as root on the underlying system. The exploit is a single authenticated request to the management interface rather than a chain, and because no special configuration is required, no feature audit will tell you that you are safe. Only version and reachability will.

Discovery

The vulnerability was found internally at Palo Alto Networks and is credited to Suraj Siddharudh. No external researcher or incident-response firm is named in the advisory, and no independent analysis has been published. As with the Cisco entry in the same KEV batch, the vendor found the flaw through its own review and then determined that it was already being exploited, so defenders are working from a single source with no second account to check it against.

Exploitation Context

Palo Alto Networks confirms exploitation but discloses very little about it. There is no attribution to a named threat actor, no victim count, and no stated date on which exploitation began. The advisory does list three associated IP addresses: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234. These should be treated as a starting point for log review rather than a complete indicator set, and matching traffic is evidence worth investigating rather than proof of compromise on its own.

Public exploit availability is unresolved. SecurityOnline reports no confirmed public proof-of-concept, and VulDB likewise records no available exploit, while a Sploitus listing titled as a PoC for this CVE appears on inspection to reproduce advisory text rather than working code. No exposure count for internet-facing PAN-OS management interfaces has been published for this CVE. Historically those counts have run into the thousands, and given that exploitation requires reaching the management interface, an organisation's real risk here is driven almost entirely by whether that interface is reachable from untrusted networks.

Remediation

1. Upgrade to a fixed build for your branch: 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, or 10.2.18-h12, or the matching maintenance hotfix listed in the vendor advisory. There are no known workarounds, so patching is the fix.
2. Restrict management interface access to trusted internal IP addresses, ideally to a single jump box. This drops the CVSS 4.0 score from 8.6 to 8.5 on paper but removes the practical attack surface, and it is the control that matters most if you cannot patch immediately.
3. Confirm no management interface is reachable from the internet. Because no special configuration is required for exploitability, reachability is the deciding factor for exposure.
4. Threat Prevention subscribers can enable Threat IDs 510046 and 510047 with Applications and Threats content 9159-10287 or later. Treat this as partial cover only: the vendor warns that "variations may exist that cannot currently be detected", and the rules only apply if inbound management traffic is routed through a data plane port, re-certificated, decrypted, and inspected, which is a substantial configuration change in itself.
5. Review authentication logs for the management interface, looking for administrator logins from unexpected sources or at unusual times, since valid credentials are a prerequisite for this attack.
6. Search firewall and network logs for traffic involving 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234.
7. If compromise is suspected, rotate every administrator credential, API key, certificate, and shared secret the appliance held, and treat Panorama-managed firewalls as potentially affected if Panorama itself was reachable.
8. Federal civilian agencies must remediate by 2026-10-17 under BOD 26-04 and complete the forensic triage the directive requires.