Palo Alto Networks disclosed CVE-2026-0322 on October 14, 2026: a code injection flaw (CWE-94) in the PAN-OS management interface that lets an authenticated attacker with network access to the management plane execute arbitrary code as root on the firewall. The vendor says it has observed “very limited exploitation” targeting the management interface, and CISA has added the bug to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of October 17.

What is affected

The flaw affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series appliances). Cloud NGFW and Prisma Access are not affected. Palo Alto reports the issue was found internally, and has not shared details of the attacks or the actor behind them. Public scoring is inconsistent: one tracker lists CVSS 8.6, others show scoring as pending.

Reported affected ranges, which differ slightly between secondary sources, are:

BranchFixed in (reported)
12.212.2.4
12.112.1.10-h2
11.211.2.16 (an additional fix is reportedly still pending)
11.111.1.16-h3
10.210.2.18-h12

Treat this table as provisional and confirm exact hotfix builds against the vendor advisory at security.paloaltonetworks.com/CVE-2026-0322 before scheduling maintenance.

Technical details

The root cause is improper neutralization of attacker-influenced input that ends up in code generation or evaluation inside the management web/API stack. Exploitation requires valid credentials, so this is not a pre-auth bug on its own. That prerequisite is weaker than it sounds in practice:

  • Management interfaces exposed to the internet are routinely targeted with credential stuffing, password spraying and reused admin credentials.
  • An attacker who has already phished or stolen an admin or read-only API account can escalate to root on the device itself, leaving the role-based access model behind.
  • Chaining with a separate authentication bypass would turn this into an unauthenticated root RCE. We have no evidence of such a chain here, but it is the scenario to plan for given the zero-day exploitation.

Palo Alto states the risk is highest when management interface access is allowed from external IP addresses on the internet. No complete workaround exists other than restricting who can reach the interface.

Impact

Root on a PAN-OS firewall or Panorama is a strong foothold. From there an attacker can read and alter security policy, extract configuration secrets (VPN pre-shared keys, certificates, LDAP and service account credentials), see User-ID mappings, tamper with logging, and pivot into the segments the device protects. Panorama is the higher-value target: compromise of a central manager can propagate configuration to every firewall it manages.

This lands in a busy month for edge devices. Ivanti Connect Secure CVE-2026-104935 and Fortinet FortiMail CVE-2026-104286 were also disclosed as exploited zero-days this week, and PAN-OS has been a repeat target this year (see our earlier coverage of CVE-2026-0300 and CVE-2026-0257). Expect opportunistic scanning for exposed management interfaces to rise now that the fix diff is public.

Mitigation

  1. Patch to the fixed release for your branch as soon as it is available for your platform. Verify build numbers in the vendor advisory.
  2. Remove internet exposure of the management interface and the Panorama web UI. Restrict it to a dedicated management network or jump host, using permitted-IP lists on the management profile.
  3. Rotate credentials for administrator and API accounts, and enforce MFA or certificate-based admin auth where supported. Review local admin accounts for ones you do not recognize.
  4. Hunt for compromise: review system and config logs for unexpected admin logins, new accounts or API keys, configuration commits you did not make, and unexpected outbound connections from the management plane. If you find signs of exploitation, treat the device as compromised: capture a tech support file, rotate all secrets stored on the device, and consider rebuilding.
  5. Prioritize Panorama and any device whose management interface has been reachable from the internet.

References