Palo Alto's Own Security Researcher Found This PAN-OS Root RCE — Attackers Beat the Patch Anyway
CVE-2026-0322 needs a stolen credential to work, which is why NVD's older scoring calls it a 7.2. Palo Alto's own CVSS v4.0 score, which factors in confirmed exploitation, puts it at 8.6 — and there is no workaround, only a patch.
Overview
A Palo Alto Networks security researcher found this bug internally before anyone had to tell the company about it — and attackers still reached it before a patch existed. CVE-2026-0322 is a code-injection flaw in the PAN-OS management interface that lets an already-authenticated attacker run arbitrary code as root on a PA-Series firewall, VM-Series firewall, or Panorama. Palo Alto shipped fixes on October 14, 2026; CISA added it to the Known Exploited Vulnerabilities catalog the same day with a three-day federal deadline. Our verdict: patch now regardless of how exposed your management interface is, because the one mitigating factor — "it needs credentials" — is not the same as "it's safe," and this is PAN-OS's third KEV entry of 2026 alone.
Scores as of October 27, 2026live record →
What's actually broken
The bug is CWE-94, code injection, in the Palo Alto Networks PAN-OS management web interface — the same interface the vendor's own deployment guide has told customers for years to keep off the internet. An attacker who already holds valid credentials and network access to that interface can execute arbitrary code with root privileges on the underlying firewall. Cloud NGFW and Prisma Access are not affected; this is on-box PAN-OS only, across PA-Series and VM-Series firewalls and both virtual and M-Series Panorama.
| Track | Earliest vulnerable build | Fixed build |
|---|---|---|
| PAN-OS 12.2 | 12.2.0 | 12.2.4 |
| PAN-OS 12.1 | 12.1.2 | 12.1.10-h2 (or an earlier hotfix branch — see vendor table) |
| PAN-OS 11.2 | 11.2.0 | 11.2.16 |
| PAN-OS 11.1 | 11.1.0 | 11.1.16-h3 |
| PAN-OS 10.2 | 10.2.0 | 10.2.18-h12 |
Why two CVSS scores disagree
| NVD / our catalog (CVSS v3.1) | Palo Alto's own advisory (CVSS v4.0) | |
|---|---|---|
| Score | 7.2 — High | 8.6 — High (8.5 if access is limited to a jump host) |
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/E:A |
| Exploitation factored in? | No — base score only | Yes — E:A ("Attacked") raises the threat-adjusted score |
Both scores agree on the hard part: privileges required are HIGH, meaning you need a login to the management interface before this bug does anything. CVSS v4.0 just weighs that differently than v3.1, and Palo Alto's own score additionally bakes in that it has already seen exploitation — v3.1's base score has no field for that at all. Read as a pair, the two numbers say the same thing two ways: this isn't a zero-click, internet-wide bug like CVE-2024-3400 was, but a single leaked or phished admin credential is now enough to end in root.
Observed exploitation
Very limited exploitation has been observed targeting the Palo Alto Networks management interface.
Palo Alto's advisory names three IP addresses tied to exploit attempts: 66.42.72.14, 208.83.239.114, and 149.248.47.234. "Very limited" is the vendor's own characterization — our catalog shows no public proof-of-concept or Metasploit/Nuclei module for this CVE as of this writing, which tracks with a narrow, targeted campaign rather than mass scanning. That can change fast once a PoC leaks, as it did for prior PAN-OS management-interface bugs.
No independent Sigma/Suricata/Nuclei rule exists for this CVE yet. The only detection currently available is Palo Alto's own Threat Prevention signature pair, and it only triggers if MGT traffic is already being decrypted and inspected — see the workaround caveat above.
This is PAN-OS's 14th KEV entry — three of them this year
CVE-2026-0322 is not an outlier for this product line. Querying our own catalog for every Palo Alto Networks CVE CISA has added to KEV turns up 14 entries going back to 2020, and the pattern is getting denser, not rarer: seven landed in 2024 alone (mostly the Expedition migration-tool bugs plus CVE-2024-3400), two more in 2025, and now three in 2026 — this one, plus two GlobalProtect/User-ID bugs from May.
| Label | Value |
|---|---|
| 2020 | 1 |
| 2022 | 1 |
| 2024 | 7 |
| 2025 | 2 |
| 2026 | 3 |
Zero prerequisites vs. one stolen credential
- Unauthenticated — zero credentials needed
- CVSS 10.0, worst case on the scale
- GlobalProtect portal, internet-facing by design
- Mass-exploited before a patch existed
- Requires an existing valid login
- CVSS 7.2 (v3.1) / 8.6 (v4.0)
- Management interface — should never face the internet
- "Very limited" exploitation reported so far
The honest reading of that comparison: CVE-2026-0322 is not 2024's nightmare scenario repeating. But "authenticated" stopped meaning "safe" years ago — credential theft, phishing and reused passwords are routine, and once an attacker has any valid login to a PAN-OS management interface, this bug turns that into root. Palo Alto's own best-practice guide for keeping MGT interfaces off the internet is the actual control here, and it has been the actual control for every one of the last several PAN-OS management-interface CVEs.
Same day, same pattern, different vendors
CISA's October 14 KEV batch wasn't just PAN-OS. It also added CVE-2026-76519, a CVSS 9.8 unauthenticated arbitrary-file-write in Cisco Secure Email Gateway's malware-scanning feature, plus an authentication-bypass/command-injection pair in Ahsay's AhsayCBS backup server. None of the three vendors share code, but all three are the same shape of problem: a management or scanning surface on an edge appliance, exploited before most customers had patched. It's the same theme we've tracked across Citrix NetScaler and Cisco ISE this year — track your whole edge-device fleet on /trends, not just one vendor's advisory page.
Disclosure to deadline
- Internal discoveryFound by Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks.
- Advisory + fixes publishedPalo Alto discloses CVE-2026-0322 and ships fixed builds for most affected tracks.
- Added to CISA KEVListed alongside Cisco Secure Email Gateway (CVE-2026-76519) and Ahsay AhsayCBS.
- PAN-OS 11.2.16 shipsThe last outstanding fixed build (11.2 track) is released a day after the advisory.
- Federal remediation deadlineBOD 26-04 deadline for FCEB agencies under the KEV listing.
What to do now
- Inventory every PA-Series firewall, VM-Series firewall, and Panorama instance, and confirm none has its management interface reachable from outside a trusted internal network.
- Patch to a fixed build: 10.2.18-h12, 11.1.16-h3, 11.2.16, 12.1.10-h2 or later, or 12.2.4 — check the exact hotfix sub-range for your 12.1 branch against Palo Alto's full table, since it has several.
- If you cannot patch immediately, route MGT traffic through a DP interface with SSL decryption enabled and turn on Threat IDs 510046/510047 — partial coverage only, not a substitute for patching.
- Audit and rotate credentials with management-interface access; this bug needs one, so a leaked or reused admin password is the actual way in.
- Check firewall and Panorama access logs for connections from 66.42.72.14, 208.83.239.114, and 149.248.47.234.
CVE and KEV data as of October 27, 2026
Sources: Palo Alto Networks, CVE-2026-0322 advisory · CISA, CISA Adds Four Known Exploited Vulnerabilities to Catalog · NVD, CVE-2026-0322