Palo Alto Networks fixes an exploited PAN-OS flaw that lets attackers run code as root on the firewall
Palo Alto Networks has released fixes for CVE-2026-0322, a remote code execution flaw in the PAN-OS management interface that it has already seen exploited in a limited number of attacks. PA-Series and VM-Series firewalls and Panorama are affected; Cloud NGFW and Prisma Access are not.
What happened
On 14 October 2026, Palo Alto Networks published an advisory for CVE-2026-0322, a code injection flaw in the PAN-OS management interface. An attacker with network access to that interface and administrator credentials can run arbitrary code with root privileges on the firewall, effectively taking full control of the device.
The vendor rates it CVSS 8.6 (high severity) but sets its suggested urgency to "highest". The issue was found by Palo Alto Networks' own internal team. The details come from the vendor advisory; NVD has not yet published the vulnerability.
Exploitation status
According to Palo Alto Networks' advisory, "very limited exploitation" targeting the management interface has been observed. The flaw is not currently listed in CISA's KEV catalog and no public exploit is known, but the vendor's own confirmation is reason enough to treat it as a priority.
Risk is highest where the management interface can be reached from internet IP addresses. Although an attacker needs high privileges, success would give them complete control over the device's confidentiality, integrity and availability.
Who is affected
The flaw affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series), with no special configuration required. Cloud NGFW and Prisma Access are not affected. Vulnerable branches are PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 below the fixed releases; older, unsupported versions should be upgraded to a supported fixed release.
What to do
Upgrade to a fixed release for your branch as soon as possible. The vendor lists these minimum versions:
- PAN-OS 12.2: 12.2.4 or later.
- PAN-OS 12.1: 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2 or later.
- PAN-OS 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 or 11.2.16 (expected on 15 October).
- PAN-OS 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 or 11.1.16-h3.
- PAN-OS 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12.
- Check now that the management interface is not reachable from the internet and restrict it to trusted internal IPs or a single jump box.
- Review accounts with administrative access and their recent activity.
- Threat Prevention customers can enable Threat IDs 510046 and 510047 (content version 9159-10287 or later); coverage is limited and requires routing management traffic through a data port and SSL decryption. This does not replace patching: no workarounds exist.
Sources
Affected technologies
Vulnerabilities (1)
| CVE | Severity | Active exploitation | Published | NVD status |
|---|---|---|---|---|
| CVE-2026-0322 | High (8.6) | ⚠ Active exploitation | 10/14/2026 | Analyzed |
Written automatically from NVD, CISA KEV and vendor advisory data. Always check affected versions and patches in the vendor's official advisory before acting.