CISA adds PAN-OS flaw allowing root code execution on Palo Alto Networks firewalls to its KEV catalogue
CISA has added CVE-2026-0322 to its catalogue of actively exploited vulnerabilities on the same day Palo Alto Networks released the fix. The flaw affects the PAN-OS management interface on PA-Series and VM-Series firewalls and Panorama, and organisations should update urgently.
What happened
This follows up on today's story about CVE-2026-0322, the PAN-OS management interface vulnerability (CVSS 8.6) that lets an authenticated attacker run code with root privileges on the firewall. What is new is that the US Cybersecurity and Infrastructure Security Agency (CISA) added it on 14 October 2026 to its KEV catalogue, which only lists flaws with confirmed active exploitation.
CISA has set 17 October 2026 as the remediation deadline for US federal agencies, a window of just three days that underlines the urgency. It is not yet known whether the flaw has been used in ransomware campaigns. The details come from the vendor advisory; NVD has not yet published an entry for this CVE.
Exploitation status
According to the Palo Alto Networks advisory, very limited exploitation targeting the management interface has been observed. The vendor rates the urgency as highest and notes that the risk is greatest when the interface is reachable from internet IP addresses.
Exploiting the flaw requires credentials with high privileges, which narrows the pool of potential attackers but not the impact: a successful attacker gains full control of the device.
Who is affected
Unpatched PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) in the 12.2, 12.1, 11.2, 11.1 and 10.2 branches is affected, as are older unsupported releases. Cloud NGFW and Prisma Access are not affected. No special configuration is needed to be exposed.
What to do
Palo Alto Networks says there are no workarounds: upgrading is the only complete fix. The minimum fixed versions per branch, according to the vendor advisory, are:
- PAN-OS 12.2: 12.2.4 or later.
- PAN-OS 12.1: 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2 (or later).
- PAN-OS 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 or 11.2.16 (the latter expected on 15 October).
- PAN-OS 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 or 11.1.16-h3.
- PAN-OS 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12.
- Unsupported versions: move to a supported, fixed release.
- Until you have upgraded, restrict management interface access to trusted internal IP addresses or a single jump box, and confirm it is not exposed to the internet.
- Threat Prevention customers: enable Threat IDs 510046 and 510047 (content version 9159-10287 or later). Coverage is limited and requires routing management traffic through a data port and decrypting inbound SSL traffic.
- Review administrative access logs for unusual activity, given that exploitation has been confirmed.
Sources
Affected technologies
Vulnerabilities (1)
| CVE | Severity | Active exploitation | Published | NVD status |
|---|---|---|---|---|
| CVE-2026-0322 | High (8.6) | ⚠ Active exploitation | 10/14/2026 | Analyzed |
Written automatically from NVD, CISA KEV and vendor advisory data. Always check affected versions and patches in the vendor's official advisory before acting.