Palo Alto Networks PAN-OS, CVE-2026-0322: on CISA's exploited list

The bottom line

Act now if you run PAN-OS firewalls or Panorama: CISA's deadline was 17 October 2026. First confirm the management interface is not reachable from the internet, then upgrade to a fixed version. If you run no PAN-OS, you can stop reading.

Free analysis report · 9 pagesPalo Alto Networks PAN-OS, CVE-2026-0322: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

An attacker who can log in to the management interface can run any code as root on the firewall. The record says the attacker needs network access and a login with high privileges. The weakness is code injection (CWE-94).

Why it matters

Our reading is that the login requirement protects you only if administrator accounts and management access are tightly held. The vendor says exploitation has been observed against the management interface, though it calls it very limited. A firewall guards the rest of the network, so root on it gives an attacker a strong position. The vendor says the risk is highest when the interface is open to the internet.

What the vendor's advisory says

We read one page on security.paloaltonetworks.com. In short:

• The vendor scores this 8.6 (HIGH) and suggests urgency HIGHEST. It says it found the issue internally.
• The vendor says no special configuration is needed to be affected.
• The vendor says very limited exploitation has been observed targeting the management interface.
• Workaround from the vendor: allow only a jump box to reach the management interface. It scores the residual risk 8.5.
• Example fix path from the vendor: 12.1.2 through 12.1.4-h* upgrades to 12.1.4-h12 or 12.1.10-h2 or later.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• "It needs a login, so it can wait." The vendor says exploitation has been observed. An attacker with a login gets root on the firewall, so a stolen or weak login is enough.
• "We run it in the cloud, so we are covered." Only Cloud NGFW and Prisma Access are unaffected. VM-Series firewalls and virtual Panorama are affected.

The wording includes conditions the score may not show: it needs privileges; the attacker must be logged in. Read the record before you decide it does not apply to you.

How we would triage it

This is our judgement.

The commands only read: they print a version or list what is installed. They come from general knowledge of this kind of product, not from the sources, so check them against the vendor's page before you run them. Words in capitals are for you to fill in.

Step 1: Find the versions you run

• List every PA-Series, VM-Series and Panorama device you run, virtual ones included.
• Read each software version and compare it with the fixed version for its branch.

show system info

Step 2: Reduce exposure

• Allow management access only from one jump box, as the vendor suggests.
• Confirm the management interface is not open to the internet.

Step 3: Patch

• Upgrade each device to the fixed version for its branch, for example 11.2.16 or 10.2.18-h12.
• The vendor says to remediate as soon as possible.

Step 4: Check for signs of misuse

• Review administrator accounts and recent management logins for anything you do not recognise.

show admins

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

Send this to your IT provider

Copy it, change the names and dates, and send it. It is a draft for you to check, not a template tested with any provider.

Hello, we need to know whether we run Palo Alto Networks PAN-OS (PA-Series, VM-Series or Panorama) and, if so, where and on which version. This concerns CVE-2026-0322, a remote code execution flaw in the management interface that the vendor says has been attacked. Please tell us whether the management interface is reachable from the internet, and restrict it to a jump box if so. Fixed versions include 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 and 10.2.18-h12. CISA's deadline was 17 October 2026. Please confirm in writing the version of each device and that the fix is installed, by a date we agree.

Signs it was used

An update closes the hole. It does not tell you whether someone used it first. CISA's required action points to its forensic triage requirements (BOD 26-04). Look for:

• Administrator accounts you did not create, or management logins from addresses you do not know.
• Configuration changes or commits that nobody on your side made.
• Unexpected outbound connections from the firewall itself.

The weakness behind it

The record classes this as CWE-94 (Improper Control of Generation of Code).

• CWE-94: Improper Control of Generation of Code →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

CISA's catalogue entry:

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

The CVE record, published by Palo_alto on 14 October 2026:

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW …

It lists these as unaffected:

• All

Versions of Palo Alto Networks PAN-OS the record lists as affected:

• 12.2.0 up to, but not including, 12.2.4
• 12.1.0 up to, but not including, 12.1.10-h2
• 11.2.0 up to, but not including, 11.2.16
• 11.1.0 up to, but not including, 11.1.16-h3
• 10.2.0 up to, but not including, 10.2.18-h12

The affected ranges end before 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12. Those are the first versions the record does not list as affected; confirm them in the vendor's advisory.

It lists these as unaffected:

• All

CISA's required action:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

What we do not know yet

• The sources do not say who is exploiting this, or how many devices are affected.
• The record does not say how an attacker would get the login the flaw requires.
• The advisory text available here is cut off, so some per-branch fixed versions are not shown.
• The sources give no indicators or log entries that show a device was exploited.
• We have not tested this against any environment. Versions and scores are as the sources state them and as at 1 November 2026; the vendor's advisory wins where it differs.
• The sections headed "The bottom line", "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong", "How we would triage it" and "Send this to your IT provider" are our interpretation of the sources, not a statement by CISA or the vendor.

• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.
• The CVE Triage Handbook →How to check, analyse and triage a CVE. Free with registration.