Follow Palo Alto Networks has released security updates addressing CVE-2026-0322, a high-severity remote code execution vulnerability affecting the management interface of PAN-OS. The flaw carries a CVSS 4.0 score of 8.6 and enables an authenticated attacker with network access to execute arbitrary code with root privileges on a vulnerable appliance/system.
Palo Alto Networks disclosed the issue on October 14, 2026, confirming that very limited exploitation had already been observed against PAN-OS management interfaces. The vulnerability impacts PA-Series and VM-Series firewalls as well as Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access are not affected.
The vulnerability is particularly significant because firewall management interfaces provide privileged control over devices positioned at critical network boundaries. Root-level compromise of such infrastructure can give attackers substantial control over firewall configuration and security operations and create opportunities for further activity against protected environments.
CISA has also added the flaw to its Known Exploited Vulnerabilities catalog, requiring applicable U.S. federal civilian agencies to remediate it by October 17, 2026.
Organizations can strengthen defenses against emerging vulnerability exploitation with SOC Prime’s AI-Native Detection Intelligence Platform, which helps security teams operationalize threat intelligence, accelerate threat hunting, and apply relevant detection content across SIEM, EDR, XDR, and Data Lake environments.
Security professionals can also use Prime Architect to research emerging threats, generate and refine detection logic, convert indicators into hunting queries, and adapt detections to organizational telemetry.
CVE-2026-0322 analysis
CVE-2026-0322 affects the PAN-OS management interface and is classified as a code injection vulnerability under CWE-94, Improper Control of Generation of Code. An attacker who already possesses valid credentials and can reach the management interface can exploit the weakness to execute arbitrary code as root on the affected device.
Unlike vulnerabilities that permit unauthenticated compromise directly from the internet, this flaw requires high privileges. However, that prerequisite does not eliminate the risk. Administrative credentials can be obtained through phishing, credential theft, reuse of compromised passwords, or earlier stages of an intrusion. Once those credentials are available, successful exploitation can transform management access into complete operating-system-level control of the firewall.
Palo Alto Networks states that no special product configuration is required for a vulnerable version to be affected. Exposure is highest when the PAN-OS management interface can be reached from external IP addresses, particularly from the public internet. The vendor recommends limiting management access to trusted internal addresses and preferably allowing access only through a designated jump box.
The affected product range includes PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 across supported PA-Series and VM-Series firewalls and Panorama appliances. The precise vulnerable build depends on the release branch. Palo Alto Networks confirms that Cloud NGFW and Prisma Access are unaffected.
The issue carries a CVSS 4.0 score of 8.6 with low attack complexity, no attack requirements, no user interaction, and high impact to confidentiality, integrity, and availability. Its privilege requirement is rated high because exploitation requires an authenticated management user.
Successful exploitation runs attacker-controlled code with root privileges. This level of access is particularly dangerous on a firewall or centralized Panorama management appliance because root privileges can potentially allow attackers to interfere with configurations, inspect local data, establish persistence, modify security controls, or use the compromised system as part of a broader intrusion.
Palo Alto Networks discovered the vulnerability internally and credited senior principal product security researcher Suraj Siddharudh with identifying and reporting the flaw. The vendor published its security advisory on October 14, 2026.
The company has confirmed “very limited exploitation” targeting PAN-OS management interfaces but has not disclosed the identity of the threat actors, the number or type of organizations targeted, or the specific post-exploitation activity observed. SecurityWeek similarly reports that no information has yet been released regarding the attackers behind the campaign.
At the time of publication, the primary sources reviewed do not document a publicly available CVE-2026-0322 PoC. However, confirmed exploitation in real-world attacks means organizations should treat remediation as urgent regardless of whether public exploit code is available.
Palo Alto Networks has shared three IP addresses associated with observed threat activity and limited exploit attempts: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. These indicators can support retrospective investigations, although security teams should not treat the absence of traffic from these addresses as proof that a system has not been targeted.
For CVE-2026-0322 detection, defenders should review management-interface authentication and access telemetry for anomalous administrative activity, unexpected source addresses, unusual login patterns, and suspicious actions occurring shortly after successful authentication.
Because successful exploitation results in root-level code execution, teams should also investigate abnormal system processes, unexpected configuration modifications, suspicious outbound network connections, newly created files, or other activity inconsistent with routine firewall administration.
CVE-2026-0322 Mitigation
Palo Alto Networks recommends upgrading affected PAN-OS installations to the appropriate fixed release as soon as possible. There is no known complete workaround for the vulnerability.
The vendor lists the following patched release thresholds:
- PAN-OS 12.2: 12.2.4 or later; PAN-OS 12.1: applicable fixed builds include 12.1.4-h12, 12.1.7-h8, and 12.1.10-h2; PAN-OS 11.2: applicable fixes include 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, and 11.2.16; PAN-OS 11.1: fixes include 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, and 11.1.16-h3; PAN-OS 10.2: fixes include 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, and 10.2.18-h12. Administrators running unsupported releases should migrate to a supported fixed version.
As an immediate risk-reduction measure, organizations should ensure that PAN-OS management interfaces are not exposed broadly to the internet. Palo Alto Networks recommends restricting access to trusted internal IP addresses and, where possible, allowing management connectivity only from a dedicated jump box.
Customers with a Threat Prevention subscription can obtain limited protection using Threat IDs 510046 and 510047 beginning with Applications and Threats content version 9159-10287. However, this protection has additional requirements, including routing management traffic through a data-plane interface, decrypting inbound management traffic, and enabling Threat Prevention inspection. The vendor explicitly describes this as limited coverage rather than a substitute for upgrading.
To Detect CVE-2026-0322 exploitation, security teams should correlate successful management-interface authentication with unusual command execution, administrative changes, or system behavior. Particular attention should be given to management sessions originating from unexpected external addresses or accounts whose normal operational patterns do not include direct firewall administration.
The published CVE-2026-0322 IOCs include 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234. Organizations should search historical network and management logs for interactions involving these addresses while also hunting for broader behavioral evidence of compromise.
Since the vulnerability requires authenticated access, administrators should additionally review privileged PAN-OS accounts for signs of credential compromise, remove unnecessary administrative users, enforce strong authentication practices, and restrict where administrative sessions can originate.
If suspicious exploitation is identified, affected appliances should be investigated for unauthorized configuration changes and abnormal processes or connections. Administrative credentials associated with the device should be considered potentially exposed and rotated after containment where appropriate.
SOC Prime’s AI-Native Detection Intelligence Platform enables security teams to accelerate detection engineering and threat hunting around actively exploited vulnerabilities while adapting detection logic to their security stack and available telemetry.
FAQ
What is CVE-2026-0322 and how does it work?
CVE-2026-0322 is a high-severity code injection vulnerability affecting the PAN-OS management interface. An attacker with valid credentials and network access to the management interface can exploit the flaw to execute arbitrary code with root privileges on an affected PA-Series or VM-Series firewall or Panorama appliance.
When was CVE-2026-0322 first discovered?
Palo Alto Networks discovered the vulnerability internally and credited Suraj Siddharudh with reporting it. The company publicly disclosed the issue on October 14, 2026. The exact date of its initial internal discovery has not been published.
What is the impact of CVE-2026-0322 on systems?
Successful exploitation gives an authenticated attacker arbitrary code execution with root privileges on the affected PAN-OS device. On a firewall or Panorama management appliance, this can result in complete compromise of the device and potentially enable unauthorized configuration changes, persistence, information access, or follow-on activity against connected infrastructure.
Can CVE-2026-0322 still affect me in 2026?
Yes. Vulnerable PA-Series and VM-Series firewalls and Panorama appliances that have not been upgraded to an applicable fixed PAN-OS release remain at risk. The threat is immediate because Palo Alto Networks has confirmed exploitation in the wild and CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.
How can I protect myself from CVE-2026-0322?
Upgrade affected PAN-OS installations to the appropriate fixed version immediately, restrict management-interface access to trusted internal systems or a dedicated jump box, and investigate privileged administrative activity for signs of compromise. Organizations should also review Palo Alto Networks’ advisory regularly for updated details for CVE-2026-0322 and additional information about observed attacks.
