Palo Alto Networks disclosed CVE-2026-0322 on October 14, 2026, a code injection vulnerability (CWE-94) in the PAN-OS management interface. An authenticated attacker with network access to the management interface can execute arbitrary code with root privileges on the firewall.

Palo Alto Networks states that "very limited exploitation has been observed targeting the Palo Alto Networks management interface." CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026, with a remediation due date of October 17, 2026.

No threat actor, campaign, or initial exploitation date has been publicly identified.

The vendor reports that there are no workarounds and that no special configuration is required for a device to be vulnerable. Any affected PAN-OS version is exposed. Risk is significantly higher when management interfaces are accessible from the public internet.

Affected Systems and Applications

Affected products include:

• PA-Series firewalls
• VM-Series firewalls
• Panorama (virtual and M-Series)

Not affected:

• Cloud NGFW
• Prisma Access

Affected Versions and Fixed Releases

PAN-OS 12.2

• Affected: Earlier than 12.2.4
• Fixed: 12.2.4 and later

PAN-OS 12.1

Fixed versions:

• 12.1.4-h12
• 12.1.7-h8
• 12.1.10-h2

PAN-OS 11.2

Fixed versions:

• 11.2.4-h22
• 11.2.7-h21
• 11.2.10-h15
• 11.2.13-h3
• 11.2.16

PAN-OS 11.1

Fixed versions:

• 11.1.4-h37
• 11.1.6-h39
• 11.1.7-h11
• 11.1.10-h35
• 11.1.13-h15
• 11.1.16-h3

PAN-OS 10.2

Fixed versions:

• 10.2.7-h38
• 10.2.10-h41
• 10.2.13-h26
• 10.2.16-h11
• 10.2.18-h12

Older unsupported PAN-OS versions are also affected and must be upgraded to a supported fixed release.

Technical Details

Vulnerability Mechanism

The vulnerability is an improper control of code generation issue (CWE-94, Code Injection; related CAPEC-242) within the PAN-OS management interface.

An authenticated attacker with network access to the management interface can execute arbitrary code as root on the firewall.

This reflects:

• Network attack vector
• Low complexity
• High privileges required
• No user interaction
• High confidentiality impact
• High integrity impact
• High availability impact

Palo Alto Networks reports the issue was discovered internally.

Key Points

• The vulnerability affects widely deployed perimeter security infrastructure and enables root-level code execution.
• PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2 are affected.
• No special configuration is required for exposure.
• No workarounds are available.
• Patching is the primary remediation.
• Palo Alto Networks rates the urgency as HIGHEST.
• Risk is greatest when management interfaces are internet-accessible.
• The vulnerability is listed in CISA's KEV catalog.
• Tenable reports an exploit is available, but public proof-of-concept code has not been independently confirmed.

Mitigation

Immediate Actions for Self-Hosted Deployments

Limit Exposure

Since no workarounds exist, reducing exposure only lowers risk and does not eliminate the vulnerability.

Recommended actions:

• Remove management interface access from the public internet.
• Restrict management access to trusted internal IP ranges.
• Route management traffic through data-plane interfaces where appropriate.
• Replace certificates used for inbound management traffic.
• Enable SSL decryption for management traffic inspection.
• Enable Threat Prevention protections on inbound management traffic.

Threat Prevention signatures:

• Threat ID 510046
• Threat ID 510047

Requirements:

• Content version 9159-10287 or later
• SSL decryption enabled

Palo Alto Networks notes that these signatures provide only limited detection coverage and are not a substitute for patching.

Patch and Upgrade

Upgrade all affected:

• PA-Series firewalls
• VM-Series firewalls
• Panorama systems

Prioritize any device whose management interface is reachable from untrusted networks.

Organizations running unsupported PAN-OS releases should upgrade directly to a supported fixed version.

No action is required for:

• Cloud NGFW
• Prisma Access

What the Cyber Fusion Center Is Doing

The CFC is monitoring the situation and analyzing the case to identify potential threat-hunting campaigns. This advisory will be updated if required.

References

• Palo Alto Networks PSIRT Advisory: https://security.paloaltonetworks.com/CVE-2026-0322
• SecurityWeek Article: https://www.securityweek.com/palo-alto-networks-patches-pan-os-zero-day-exploited-for-remote-code-execution/
• CISA KEV Catalog: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-0322
• FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-0322