Palo Alto Patches PAN-OS CVE-2026-0322 as Attackers Reach Management Interfaces

An attacker who already holds high-privilege credentials and can reach the PAN-OS management interface can run arbitrary code as root on a Palo Alto Networks firewall (no special configuration required), according to the vendor's advisory for CVE-2026-0322. Palo Alto published the advisory on October 14, 2026 and said exploitation has been observed.

Fixed builds exist in every supported branch. The advisory lists no workaround, only exposure reduction.

What an attacker needs

CVE-2026-0322 is a code injection bug (CWE-94) in the management interface of PA-Series and VM-Series firewalls and of Panorama, in both virtual and M-Series form. Cloud NGFW and Prisma Access are not affected.

Palo Alto scores it 8.6 under CVSS 4.0, rated High, with privileges required marked High and attack vector marked Network. If management access is limited to a jump box, the vendor scores it 8.5. Exploit maturity is listed as "ATTACKED" and automatable as "NO."

The distinction matters. This is not a pre-authentication hole like the Ivanti Connect Secure flaw reported the day before. The attacker needs a working administrative login first, so the likeliest victims are firewalls whose management plane faces the internet or whose admin credentials have already leaked.

The score understates the risk in one case. A firewall with an exposed management interface and a reused or phished administrator password has no second barrier between the attacker and root. Palo Alto itself says the most risk is where management access is reachable from the internet.

What is known about the attacks

The advisory says "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." It lists three IP addresses associated with the activity: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234.

Palo Alto credits internal discovery to Suraj Siddharudh. It does not say how many customers were hit, which credentials were used, or what the attackers did after obtaining root.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 14, 2026, one of four additions that day, alongside a Cisco email gateway bug and the two AhsayCBS flaws. The catalog gives federal civilian agencies until October 17, 2026.

Fixed versions

The advisory, updated October 15 to add PAN-OS 11.2.16, tells customers to move to the listed build or later in their branch.

Branch	Fixed in
12.2	12.2.4
12.1	12.1.4-h12, 12.1.7-h8, 12.1.10-h2
11.2	11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16
11.1	11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3
10.2	10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12

Unsupported versions must upgrade to a supported fixed release. Match the hotfix suffix to the minor version you already run.

If you cannot patch today

Palo Alto says there are no known workarounds. Restricting management access to trusted internal IP addresses, or to a single jump box, reduces exposure and follows the vendor's own best-practice guidance.

Customers with Threat Prevention and SSL Decryption can turn on Threat IDs 510046 and 510047 (content update 9159-10287 or later). The vendor says coverage is limited and variants may go undetected. Other partial measures it lists are routing management traffic through a data-plane port, replacing the inbound management certificate, decrypting inbound management traffic and enabling Threat Prevention on it.

Operators should also search firewall logs for connections from the three listed addresses.

The same CISA batch carried the AhsayCBS pair, also a network-edge product. The CISA deadline for PAN-OS passed on October 17.