News Vulnerabilities & Zero-Days

Palo Alto Networks PAN-OS flaw CVE-2026-0322 exploited for root code execution

Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management interface flaw that lets an authenticated attacker run code as root, after observing very limited exploitation. CISA gave US federal agencies until 17 October 2026 to fix it.

Published
Illustration of a firewall wall with a glowing admin console door being pried open by a key-shaped beam of code.

Key takeaways

  • CVE-2026-0322 lets an authenticated attacker with management interface access run code as root on PAN-OS.
  • Palo Alto Networks has observed very limited exploitation and lists three attacker IP addresses.
  • PA-Series, VM-Series and Panorama are affected; Cloud NGFW and Prisma Access are not.
  • There is no workaround; upgrade to the fixed build for your PAN-OS train.
  • CISA gave US federal agencies until 17 October 2026 to patch.

Palo Alto Networks published fixes on 14 October 2026 for CVE-2026-0322, a code injection flaw in the PAN-OS management interface. An authenticated attacker with network access to the interface can run arbitrary code with root privileges on the firewall. The company says it has observed very limited exploitation.

What is the vulnerability? #

The flaw is rated 8.6 (High) on CVSS 4.0 and classed as code injection (CWE-94). Palo Alto Networks gives it its highest suggested urgency and says no special configuration is needed to be affected. It was found internally by Suraj Siddharudh of Palo Alto Networks.

The attacker needs valid credentials and network access to the management interface. Palo Alto Networks scores the flaw 8.5 when access is limited to a jump box.

Which products are affected? #

PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) are affected. Cloud NGFW and Prisma Access are not.

PAN-OS release Fixed in
12.2 12.2.4
12.1 12.1.4-h12, 12.1.7-h8, 12.1.10-h2
11.2 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16
11.1 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3
10.2 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12

Pick the fixed build for your maintenance train. Palo Alto Networks gave 15 October as the estimated date for 11.2.16. Customers on unsupported versions need to upgrade to a supported fixed release.

How serious is the exploitation? #

Palo Alto Networks says "very limited exploitation has been observed targeting the Palo Alto Networks management interface". It has not said who is behind it or when it began. The advisory lists three IP addresses as indicators: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234.

CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on 14 October and gave US federal civilian agencies until 17 October to fix it, Help Net Security reported.

What should firewall teams do? #

  1. Upgrade to the fixed build for your PAN-OS train. The advisory says there are no known workarounds.
  2. Restrict management interface access to trusted internal IP addresses, ideally a single jump box.
  3. Check logs for management interface connections from the three IP addresses above.
  4. Threat Prevention customers can get limited coverage by enabling Threat IDs 510046 and 510047, which requires SSL decryption of management traffic.

Sources

  1. Palo Alto Networks security advisory for CVE-2026-0322, Palo Alto Networks
  2. CISA adds PAN-OS, Cisco and Ahsay flaws to KEV, Help Net Security

Questions this raises

Does an attacker need to log in?
Yes. The attacker needs valid credentials and network access to the management interface. Restricting that interface to trusted internal addresses reduces the risk.
Is Prisma Access affected?
No. Palo Alto Networks says Cloud NGFW and Prisma Access are not affected.
Who is exploiting it?
Palo Alto Networks has not said. It has published three IP addresses tied to exploitation attempts.

Zero-DayVulnerabilityCISA KEVNetwork SecurityPalo Alto Networks