CVE-2026-0322
PAN-OS management interface authenticated remote code execution (CVE-2026-0322)
PAN-OS management interface allows an authenticated attacker with network access to execute arbitrary code as root. Exploitation has been observed. Update to fixed PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 releases.
What happened
A vulnerability in the PAN-OS management interface permits an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The attack is carried out over the network, has low attack complexity and requires no user interaction, but requires elevated authenticated access. Palo Alto Networks rates the issue high with a CVSS 4.0 score of 8.6.
Exploitation is active. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on 14 October 2026 with a due date of 17 October 2026. ENISA EUVD records exploitation since 14 October 2026, and Palo Alto Networks states that very limited exploitation has been observed targeting the management interface.
Successful exploitation gives an attacker root-level control over the affected firewall, with high impact to confidentiality, integrity and availability. Palo Alto Networks notes that restricting management interface access to only trusted internal IP addresses minimises the risk.
Who is affected
This affects PAN-OS software on PA-Series and VM-Series firewalls and on Panorama, including virtual and M-Series Panorama. Affected releases are 12.2.0 through versions before 12.2.4, 12.1.0 through versions before 12.1.10-h2, 11.2.0 through versions before 11.2.16, 11.1.0 through versions before 11.1.16-h3, and 10.2.0 through versions before 10.2.18-h12. Cloud NGFW and Prisma Access are not impacted.
What to do now
- Apply the fixed PAN-OS release for your branch. The fixed releases are:
- PAN-OS 12.2: 12.2.4
- PAN-OS 12.1: 12.1.4-h12, 12.1.7-h8, 12.1.10-h2
- PAN-OS 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16
- PAN-OS 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3
- PAN-OS 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12
- Palo Alto Networks states that no known workarounds exist. Customers with a Threat Prevention subscription can obtain limited coverage by enabling Threat ID 510046 and 510047 from Applications and Threats content version 9159-10287 and later, and following the configuration steps in Palo Alto Networks' advisory.
- Restrict access to the management interface to trusted internal IP addresses according to Palo Alto Networks' recommended best practice deployment guidelines.
How to detect it
Palo Alto Networks has not published specific indicators of compromise for this issue. Because the vendor reports exploitation targeting the management interface, review management-plane authentication and command activity for unexpected authenticated sessions or changes. If you use Threat Prevention, confirm that Threat IDs 510046 and 510047 are enabled so attempted exploitation can be detected or limited.
Beyond the patch
An exploited remote code execution flaw on a firewall management interface is a reason to verify whether the device was reached before patching. Because CISA KEV and ENISA EUVD record active exploitation, Incident Response Retainer and Managed Detection & Response (MDR) provide detection and response if an attacker has already used valid credentials. Implementation & Assessment Services can test and harden management-plane exposure so the next PAN-OS issue does not find the same door open.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| PAN-OS | 12.2.0 – < 12.2.4 12.1.0 – < 12.1.10-h2 11.2.0 – < 11.2.16 11.1.0 – < 11.1.16-h3 10.2.0 – < 10.2.18-h12 | 12.2.4 12.1.4-h12 12.1.7-h8 12.1.10-h2 11.2.4-h22 11.2.7-h21 11.2.10-h15 11.2.13-h3 11.2.16 11.1.4-h37 11.1.6-h39 11.1.7-h11 11.1.10-h35 11.1.13-h15 11.1.16-h3 10.2.7-h38 10.2.10-h41 10.2.13-h26 10.2.16-h11 10.2.18-h12 >= 12.2.4 |