Palo Alto Networks PAN-OS · Exploitation confirmed

CISA confirms active exploitation of authenticated RCE in PAN-OS

Oct 13, 2026 · 1 min read

CVE-2026-0322 lets an authenticated attacker with network access execute code with root privileges on the PAN-OS management interface, affecting PA-Series, VM-Series and Panorama. CISA listed the flaw in its KEV catalog, indicating active exploitation, and Palo Alto Networks, which published the advisory on 2026-10-14, reports very limited exploitation. Fixed versions exist for releases 10.2 through 12.2: upgrade with highest urgency and restrict management interface access.

By HIFY Radar newsroom Updated 10/26/2026 01:29 PM Get this every day →← Back to the feed 2 sources

CriticalVulnerabilityExploitation confirmedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

CISA added CVE-2026-0322, a flaw in Palo Alto Networks PAN-OS firewall software, to its catalog of actively exploited vulnerabilities. An attacker with valid credentials and network access can execute code with root privileges on the firewall. The vendor reports very limited exploitation and has already released fixes.

Why it matters

The firewall guards the corporate network; root-level compromise can mean full control of the device and the traffic it inspects. PA-Series, VM-Series firewalls and Panorama are affected; Cloud NGFW and Prisma Access are not. No special configuration is required for an environment to be vulnerable, and risk is highest with the management interface exposed to the internet.

What to do

Upgrade PAN-OS with highest urgency: 12.2.4 or later on release 12.2, or the fixed versions of releases 12.1, 11.2, 11.1 and 10.2. Restrict management interface access to trusted internal IPs or a jump box. No known workaround exists.

For the technical team

CVE: CVE-2026-0322
Affected: Palo Alto Networks PAN-OS · PAN-OS on PA-Series, VM-Series and Panorama (virtual and M-Series): 12.2 < 12.2.4; 12.1 < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2; 11.2 < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16; 11.1 < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3; 10.2 < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12. Cloud NGFW and Prisma Access are not affected. Unsupported versions: all affected.
Exploitation: Palo Alto Networks rates exploit maturity as ATTACKED and reports very limited exploitation targeting the management interface. CISA listed CVE-2026-0322 in the KEV catalog, indicating active exploitation.
Fix: Upgrade: 12.2 to 12.2.4+; 12.1 to 12.1.4-h12+, 12.1.7-h8+ or 12.1.10-h2+; 11.2 to 11.2.4-h22+, 11.2.7-h21+, 11.2.10-h15+, 11.2.13-h3+ or 11.2.16+; 11.1 to 11.1.4-h37+, 11.1.6-h39+, 11.1.7-h11+, 11.1.10-h35+, 11.1.13-h15+ or 11.1.16-h3+; 10.2 to 10.2.7-h38+, 10.2.10-h41+, 10.2.13-h26+, 10.2.16-h11+ or 10.2.18-h12+. Unsupported versions: move to a supported fixed version. No known workarounds. Threat Prevention subscription with Threat IDs 510046 and 510047 (content 9159-10287 and later) provides limited coverage and requires routing MGT traffic through a DP port, replacing the inbound traffic management certificate, decrypting traffic to the interface and enabling threat prevention on inbound traffic.
Vector: Code injection (CWE-94, CAPEC-242) in the PAN-OS management interface. Network vector (AV:NETWORK), low complexity, no user interaction and no attack requirements; requires an authenticated attacker with network access (PR:HIGH) and enables arbitrary code with root privileges. No special configuration is required to be affected; risk is highest when the management interface allows access from external internet IP addresses.
More details: Discovered internally, credited to Suraj Siddharudh (internal reporter). Advisory published 2026-10-14, updated 2026-10-15. CVSS-BT 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A), severity HIGH, suggested urgency HIGHEST, response effort MODERATE, not automatable. Vendor-recommended mitigation: restrict management interface access to trusted internal IPs or a single dedicated jump box.