CVE-2026-0322: PAN-OS management root RCE, CVSS 8.6
Authenticated PAN-OS management interface code injection

CVE-2026-0322: PAN-OS management root RCE, CVSS 8.6

Palo Alto Networks published CVE-2026-0322 on 14 October 2026. It is a code-injection flaw in the PAN-OS management interface, scored 8.6. An authenticated attacker who can reach that interface can run code as root.

What happened

Palo Alto rates urgency as highest and marks exploit maturity as attacked. The company said exploitation so far is very limited and aimed at the management interface. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 14 October. Federal civilian agencies have until 17 October.

This is not a pre-auth internet worm. The attacker needs valid high-privilege credentials and a network path to management. That path is common when the management plane is published to the internet or reachable from a compromised admin workstation.

Palo Alto listed three addresses tied to exploit attempts: 66.42.72.14, 208.83.239.114, and 149.248.47.234.

Who is affected

PA-Series firewalls, VM-Series firewalls, and Panorama, virtual and M-Series, on vulnerable PAN-OS builds are in scope. Cloud NGFW and Prisma Access are not.

  • PAN-OS 12.2 before 12.2.4
  • PAN-OS 12.1 before 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2
  • PAN-OS 11.2, 11.1, and 10.2 below the hotfix levels in the advisory
  • Unsupported older trains, which must move to a supported fixed release

PAN-OS 11.2.16 was still listed with an ETA of 15 October 2026. Other 11.2 hotfix trains already have fixes.

What to do now

Take the management interface off the internet, then upgrade to a fixed PAN-OS release. There is no workaround. Threat Prevention signatures 510046 and 510047 only cover known patterns, and only if management traffic is decrypted and inspected. Treat them as a speed bump, not a patch.

Hunt management-plane logins from 66.42.72.14, 208.83.239.114, and 149.248.47.234, and from any admin account that should not reach the firewall. If those hits exist, rotate the admin credentials used on that device and review what the account could reach behind it.

Source: Palo Alto Networks advisory, PAN-OS management RCE advisory.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

CVE-2026-76519: Cisco Secure Email Gateway root via one attachment
File Reputation path traversal to root on Cisco SEG