{"id":"pan-os-management-code-injection-oct-2026","category":"patch","status":"closed","title":"Palo Alto Networks PAN-OS firewalls: management interface code injection CVE-2026-0322 used in attacks","tldr":"Palo Alto PAN-OS firewalls and Panorama have a flaw (CVE-2026-0322) that lets someone with a management login run code as root. Attacks are confirmed but limited. Update to your branch's fixed version and keep the management interface off the internet.","summary":"Palo Alto Networks disclosed CVE-2026-0322 on 14 October 2026. It is a code injection flaw in the management interface of PAN-OS, the software on its PA-Series and VM-Series firewalls and on Panorama, its central management product. An attacker who has valid credentials and network access to the management interface can run their own code with root privileges on the device. No special configuration is needed to be affected. Palo Alto says it has seen very limited exploitation and lists three IP addresses linked to the attempts. CISA added the flaw to its list of exploited vulnerabilities the same day. Palo Alto rates it high, with a CVSS 4.0 score of 8.6; the US National Vulnerability Database lists 7.2. Fixes exist for every supported branch (10.2, 11.1, 11.2, 12.1 and 12.2), with PAN-OS 11.2.16 added on 15 October. Palo Alto says there is no true workaround. Restricting management access to trusted internal addresses lowers the risk, and two Threat Prevention signatures give limited coverage. Cloud NGFW and Prisma Access are not affected.","action":"If your business runs Palo Alto firewalls or Panorama, ask your IT provider to upgrade PAN-OS to the fixed version for your branch (for example 12.2.4, 11.2.16 or 10.2.18-h12) and to check the device for signs of break-in. Make sure the management interface is not reachable from the internet. Home users are not affected.","product":"Palo Alto Networks PAN-OS (PA-Series and VM-Series firewalls, Panorama)","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-0322"],"tags":["palo-alto","pan-os","firewall","panorama","code-injection","cisa-kev","exploited"],"affected":["PAN-OS 12.2 before 12.2.4","PAN-OS 12.1 before 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2","PAN-OS 11.2 before 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 and 11.2.16","PAN-OS 11.1 before 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3","PAN-OS 10.2 before 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 and 10.2.18-h12","Older, unsupported PAN-OS versions"],"fixed":["12.2.4","12.1.4-h12, 12.1.7-h8, 12.1.10-h2","11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16","11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3","10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12"],"matches":[],"sources":[{"kind":"advisory","title":"CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface","url":"https://security.paloaltonetworks.com/CVE-2026-0322","by":"Palo Alto Networks","date":"2026-10-15"},{"kind":"news","title":"PAN-OS vulnerability exploited, CISA warns","url":"https://cybersecuritynews.com/pan-os-vulnerability-exploited-cisa-warns/amp/","by":"Cyber Security News","date":"2026-10-14"}],"started":"2026-10-14","closed":"2026-10-15","created":"2026-11-03T22:06:50.569Z","updated":"2026-11-03T22:06:50.569Z","cve_notes":[{"cve":"CVE-2026-0322","name":"Code injection in PAN-OS management interface","what":"A code injection flaw in the management interface of PAN-OS firewalls and Panorama that lets an attacker who has valid credentials and network access run their own code as root; the vendor rates it CVSS 4.0 8.6 and the NVD lists 7.2.","severity":"high","cvss":8.6}],"timeline":[{"at":"2026-10-15","added":"2026-11-03T22:05:27.736Z","kind":"new-fix","text":"Palo Alto Networks updated the advisory to say PAN-OS 11.2.16 had been published. No other changes are listed, and the advisory still says no workarounds exist.","url":"https://security.paloaltonetworks.com/CVE-2026-0322","by":"Palo Alto Networks","patch":"patched"},{"at":"2026-10-14","added":"2026-11-03T22:05:27.736Z","kind":"cisa-added","text":"CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities list the same day. Reporting says US federal agencies had until 17 October to apply mitigations and were told to check for signs of intrusion.","url":"https://cybersecuritynews.com/pan-os-vulnerability-exploited-cisa-warns/amp/","by":"Cyber Security News","patch":null},{"at":"2026-10-14","added":"2026-11-03T22:05:27.736Z","kind":"disclosed","text":"Palo Alto Networks published its advisory for CVE-2026-0322, a code injection flaw in the PAN-OS management interface that lets a logged-in attacker run code as root. It reported very limited exploitation and listed three IP addresses linked to the attempts, with fixes for the supported branches.","url":"https://security.paloaltonetworks.com/CVE-2026-0322","by":"Palo Alto Networks","patch":"patched"}],"url":"https://hard.fyi/live/pan-os-management-code-injection-oct-2026/","json":"https://hard.fyi/api/live?id=pan-os-management-code-injection-oct-2026"}