PAN-OS CVE-2026-0322: Root RCE on Firewalls Now on CISA KEV

Palo Alto Networks disclosed CVE-2026-0322 on 14 October 2026, an authenticated code-injection flaw in the PAN-OS management interface that gives an attacker code execution as root. The vendor says it has seen "very limited exploitation", and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day with a 17 October due date. There is no workaround, so the fix is an upgrade.

What happened

Palo Alto Networks published advisory CVE-2026-0322, "PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface", on 14 October. The company credits the discovery to an internal reporter, Suraj Siddharudh. The flaw is classed as CWE-94, code injection, and lets an authenticated attacker with network access to the management interface run arbitrary code with root privileges on the firewall.

The advisory states: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." It lists three IP addresses that it associates with threat activity and limited exploit attempts: 66.42.72.14, 208.83.239.114 and 149.248.47.234.

CISA added CVE-2026-0322 to KEV on 14 October as "Palo Alto Networks PAN-OS Code Injection Vulnerability", with a remediation due date of 17 October. Its entry lists known ransomware use as "Unknown" and marks forensic triage as required. The NVD record was published the same day and has status "Received": NVD has not analysed it, and the 8.6 score on it is the one Palo Alto supplied.

Why it matters

The affected component is the management plane of a perimeter firewall. Root code execution there means control of the device that enforces network policy and, on Panorama, of the system that manages other firewalls. The advisory does not describe what attackers did after exploitation, and no victims, actor or device counts have been published.

The severity should be read carefully. Palo Alto scores the flaw CVSS 4.0 8.6 (High) with privileges required set to High, so the attacker needs valid credentials first. The advisory does not say how attackers obtain them. Palo Alto rates exploit maturity "Attacked", suggested urgency "Highest", automatable "No". The score drops only to 8.5 if access is restricted to a jump box. The flaw is therefore not a pre-authentication bug, but a confirmed in-the-wild flaw on a high-value device warrants a fast patch.

Technical details

CVE-2026-0322 timeline, 14 to 17 October 2026.

Who is affected. PAN-OS on PA-Series and VM-Series firewalls, and on Panorama (virtual and M-Series). No special configuration is needed to be affected. Cloud NGFW and Prisma Access are not affected.

Exposure. Palo Alto says risk is highest when the management interface is reachable from external IP addresses, and lowest when access is limited to trusted internal IPs. It recommends reaching the interface through a jump box. The advisory does not publish exploit details, and we do not speculate on the injection point.

Fixed versions. Upgrade to the fixed build for your branch, or later:

Each row lists the builds for that branch; PAN's Solution table maps every running version to its target. The newest build on each branch (12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12) works as the target from any version on that branch. There is a gap for 11.2.14 and 11.2.15: their only listed fix is 11.2.16, which the advisory still showed as "ETA: 10/15" when we checked on 15 October, with no released fix yet. Until it ships, those users are limited to the management lockdown and the limited-coverage Threat IDs below. We do not suggest a downgrade path, because the vendor lists none. Older, unsupported PAN-OS versions should move to a supported fixed version. The advisory states that no known workarounds exist.

Detection, with limits. Threat IDs 510046 and 510047 (Threat Prevention, Applications and Threats content version 9159-10287 or later) give "limited coverage". They need management traffic routed through a data-plane interface, a replaced certificate for inbound traffic, SSL decryption of inbound traffic to the management interface, and Threat Prevention enabled on that traffic. Palo Alto warns that variations may exist that these signatures cannot detect, and recommends upgrading instead.

What defenders should do

1. Patch first. Move PA-Series, VM-Series and Panorama to the fixed build for your branch. Users on 11.2.14 or 11.2.15 must wait for 11.2.16, so do step 2 now. CISA's due date for federal agencies is 17 October.
2. Lock down the management interface now. Remove any exposure to the internet and restrict access to trusted internal IPs, ideally through a jump box. This reduces exposure but is not a fix, because the advisory says no workaround exists.
3. Check for exposure and prior activity. Search firewall and perimeter logs for connections from 66.42.72.14, 208.83.239.114 and 149.248.47.234. A hit is a reason to start incident response, while no hit is not proof of safety.
4. Treat credentials as part of the risk. Exploitation needs authentication, so review administrator accounts and recent management logins. This is our inference from the privilege requirement, not a Palo Alto finding.
5. Triage for compromise, not only patch. CISA's KEV entry marks forensic triage as required. Under BOD 26-04, federal agencies must remediate or mitigate within three days and also triage the asset to assess whether it is already compromised; CISA says to discontinue use of the product if mitigations are unavailable. Other organisations can use the same model: patch, then check the device for signs of compromise.
6. Do not rely on the Threat IDs alone. They need SSL decryption of management traffic and Palo Alto itself calls the coverage limited.

What is still unclear

• How attackers obtain the credentials the flaw requires.
• What attackers did after exploitation, who they are, and how many devices were affected. The advisory and KEV entry name no actor, victim or count.
• Whether 11.2.16 has shipped. The advisory still listed it as expected on 15 October when we checked.
• Whether the scale of exploitation is larger than "very limited". CISA's KEV listing signals confirmed exploitation, while Palo Alto's wording is cautious. We found no independent researcher write-up.
• NVD has not yet analysed the record, so its data may change.

If you run PAN-OS, related coverage: Palo Alto zero-day CVE-2026-0300 is a different PAN-OS flaw: an unauthenticated User-ID Authentication Portal zero-day exploited 26 days before disclosure, whereas CVE-2026-0322 needs credentials on the management interface (we also covered the Palo Alto Expedition firewall flaws).

Sources

• Palo Alto Networks PSIRT, CVE-2026-0322: https://security.paloaltonetworks.com/CVE-2026-0322
• NVD, CVE-2026-0322: https://nvd.nist.gov/vuln/detail/CVE-2026-0322
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322