CVE-2026-0322: 
PAN-OS vulnerability analysis and mitigation

CVE-2026-0322 is an authenticated remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software. Discovered internally by Palo Alto Networks researcher Suraj Siddharudh, it was publicly disclosed on October 14, 2026. The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) across versions 10.2.x (< 10.2.18-h12), 11.1.x (< 11.1.16-h3), 11.2.x (< 11.2.16), 12.1.x (< 12.1.10-h2), and 12.2.x (< 12.2.4); Cloud NGFW and Prisma Access are not affected. It carries a CVSS v4.0 base score of 8.6 (High) and a CVSS v3.1 base score of 7.2 (High) (PAN Advisory, CISA KEV).

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection), meaning the PAN-OS management interface fails to properly neutralize user-supplied input before incorporating it into code execution paths. An authenticated attacker with network access to the management interface can inject malicious code that is executed with root privileges on the underlying firewall operating system. No special configuration beyond default management interface exposure is required to be affected. The attack vector is network-based, requires high privileges (valid management credentials), and no user interaction, making it exploitable by any authenticated administrator-level account with access to the management plane (PAN Advisory, GitHub Advisory).

Successful exploitation grants an authenticated attacker full root-level code execution on the affected Palo Alto Networks firewall or Panorama management system, resulting in complete compromise of confidentiality, integrity, and availability of the device. An attacker with root access could exfiltrate firewall configurations (including VPN credentials, security policies, and network topology), modify or disable security rules, install persistent backdoors, or pivot to internal network segments protected by the firewall. Given that firewalls are critical network chokepoints, compromise of these devices can enable broad lateral movement and undermine the entire network security posture of an organization (PAN Advisory, CISA KEV).

CVE-2026-0322 has been confirmed as actively exploited in the wild, with Palo Alto Networks reporting very limited exploitation targeting the management interface at time of disclosure. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026, with a remediation due date of October 17, 2026 — a three-day deadline reflecting the severity of active exploitation (CISA KEV). The EPSS score is approximately 1.076% (64th percentile), and the CVSS v4.0 exploit maturity is rated 'ATTACKED' (GitHub Advisory). A GitHub repository claiming to contain a PoC was assessed as a fake claim (document-only, no exploit code). Palo Alto Networks has published associated threat actor IP addresses: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234 (PAN Advisory). No specific threat actor attribution has been publicly confirmed.

1. Credential Acquisition: Obtain valid administrative credentials for the PAN-OS management interface through phishing, credential stuffing, or insider access — exploitation requires authenticated access with high privileges.
2. Reconnaissance: Identify target PAN-OS management interfaces (typically HTTPS on port 443 or 4443) using network scanning or Shodan/Censys queries for Palo Alto management portals running vulnerable versions (PAN-OS 10.2.x < 10.2.18-h12, 11.1.x < 11.1.16-h3, 11.2.x < 11.2.16, 12.1.x < 12.1.10-h2, 12.2.x < 12.2.4).
3. Authentication: Log in to the management interface using the acquired credentials.
4. Code Injection: Submit a crafted request to a vulnerable management interface endpoint containing a malicious code payload that exploits the CWE-94 code injection flaw — the management interface fails to sanitize the input before passing it to a code execution context.
5. Root Code Execution: The injected payload executes with root privileges on the firewall OS, enabling the attacker to run arbitrary OS commands, exfiltrate configurations, establish persistence (e.g., reverse shell, SSH backdoor), or modify firewall rules to facilitate further network access (PAN Advisory, CISA KEV).

• Network: Inbound connections to the PAN-OS management interface (port 443/4443) from the following threat actor IPs: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, 149[.]248[.]47[.]234; unexpected outbound connections from the firewall management IP to external hosts.
• Network: Management interface access from untrusted or external IP addresses not in the approved management access list.
• Logs: PAN-OS management access logs showing authenticated sessions followed by unusual command execution or configuration changes; anomalous API calls to management endpoints.
• Logs: System logs showing root-level process spawning from management interface processes; unexpected privilege escalation events.
• File System: New or modified files in system directories not associated with normal PAN-OS operations; presence of web shells or backdoor scripts in management interface directories.
• Process: Unexpected processes running as root spawned from management interface daemons; unusual network listeners or outbound connections initiated by system processes.
• Configuration: Unauthorized changes to firewall security policies, administrator accounts, or management access IP allow-lists (PAN Advisory).

Palo Alto Networks has released patched versions across all affected branches. Organizations should upgrade to the following minimum fixed versions: PAN-OS 10.2 → 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, or 10.2.18-h12; PAN-OS 11.1 → 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3; PAN-OS 11.2 → 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16; PAN-OS 12.1 → 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2; PAN-OS 12.2 → 12.2.4. No general workarounds exist, but risk can be significantly reduced by restricting management interface access to trusted internal IP addresses only (jump box architecture). Customers with a Threat Prevention subscription can enable Threat IDs 510046 and 510047 (from content version 9159-10287+) as a partial mitigation, which requires routing management traffic through a DP port with SSL decryption enabled. CISA mandated remediation by October 17, 2026 for federal agencies (PAN Advisory, CISA KEV).

The vulnerability generated significant attention across the security community immediately following disclosure. BleepingComputer, The Hacker News, SecurityWeek, and CSO Online all published coverage highlighting the active exploitation and CISA's unusually short three-day remediation deadline (BleepingComputer, CSO Online). Security researchers on Mastodon and Bluesky noted the irony of firewall security products being exploited as attack vectors. The SOC Prime team published a detection analysis (SOC Prime), and multiple national CERTs including HKCERT, CERT.at, and Canada's Cyber Centre issued advisories. The Reddit cybersecurity community actively discussed the implications, with many noting that management interface exposure to the internet remains a persistent misconfiguration problem despite repeated vendor warnings.