CVE-2026-0322

PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

Exploited in the wild. In CISA KEV since 2026‑10‑14. Fixed versions are out.

CVSS 3.17.2High EPSS percentile68th1.2% chance in 30 days CISA KEVListedsince 2026-10-14, due 2026-10-17
Public exploit: 0 sources Fix4 products6 fixed builds listed below

Published 2026-10-14Updated 2026-10-15Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Palo Alto Networks Cloud NGFWFixed buildsAllStated by: CVE record
Palo Alto Networks PAN-OSAffected: ≥ 12.2.0, < 12.2.4Upgrade to: 12.2.4Affected: ≥ 12.1.0, < 12.1.10-h2Upgrade to: 12.1.10-h2Affected: ≥ 11.2.0, < 11.2.16Upgrade to: 11.2.16Affected: ≥ 11.1.0, < 11.1.16-h3Upgrade to: 11.1.16-h3 + 1 more branchStated by: CVE record
Palo Alto Networks Prisma AccessFixed buildsAllStated by: CVE record
Paloaltonetworks Pan-osAffected: < 10.2.0Upgrade to: 10.2.0Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check which PAN-OS version your PA-Series or VM-Series firewall (or Panorama) is running, and confirm the management interface is reachable only from trusted internal IPs.
If you're on PAN-OS 12.2.0–12.2.3, upgrade to 12.2.4 or later.
If you're on PAN-OS 12.1.8–12.1.10-h*, upgrade to 12.1.10-h2 or later (12.1.5–12.1.7-h* should go to 12.1.7-h8 or 12.1.10-h2).
If you're on PAN-OS 11.2.x, upgrade to 11.2.16; on 11.1.x upgrade to 11.1.16-h3; on 10.2.x upgrade to 10.2.18-h12.
If you can't patch immediately, restrict management-interface access to trusted internal IP addresses only and enable Threat Prevention signatures 510046 and 510047 as a stopgap.
Cloud NGFW and Prisma Access deployments are not affected by this issue.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

4 publishers

Advisory coverage
as reported · Oct 15, 2026·Help Net Security summary
Palo Alto Networks released patches for CVE-2026-0322, a zero-day RCE vulnerability in PAN-OS management interfaces that has been actively exploited in the wild.
as reported · Oct 15, 2026·SecurityWeek summary
Added to CISA KEV catalog
Oct 14, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 3 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

In plain language

Written by AI from the record

This is a serious flaw in Palo Alto Networks' PAN-OS firewall software that lets someone who's already logged into the management panel take total control of the device, and attackers are actively exploiting it right now — if you run PAN-OS firewalls, act immediately.

Authenticated RCE (CWE-94, arbitrary code/command execution) in the PAN-OS management interface allows a logged-in user to run arbitrary commands with root privileges, leading to full device compromise; actively exploited in the wild and listed in CISA KEV.

If you're affected

Full firewall/network takeover
Network-wide traffic interception
Operational disruption / outage risk
Ransomware or further network intrusion
Loss of security monitoring

What is it

Think of the firewall's management panel as the control room for your building's security system. This flaw means someone who already has a working login to that control room can plant a hidden command that gives them full root-level control of the whole system — not just the settings they were supposed to touch, but everything.

Who is affected

This matters to you if you run Palo Alto Networks PAN-OS on PA-Series or VM-Series firewalls, or on Panorama (virtual or M-Series) management appliances. Cloud NGFW and Prisma Access are not affected by this specific issue. It only becomes a real risk if an attacker already has valid access to log into the management interface, so locking that interface down to trusted internal addresses matters.

How urgent is it

Attackers are already exploiting this flaw in real-world attacks, and it's on CISA's confirmed-exploitation list with a remediation deadline of October 17, 2026 — just two days away. There is no effective workaround, so patching is the only real fix; treat this as an emergency, not routine maintenance.

What to do — in detail

Inventory all PAN-OS deployments (PA-Series, VM-Series, Panorama virtual/M-Series) and confirm current version and management-interface exposure (internet-facing vs. restricted to trusted IPs).
Target fixed versions per branch: 12.2.4+ (from 12.2.0–12.2.3), 12.1.10-h2+ (from 12.1.8–12.1.10-h*; or 12.1.7-h8/12.1.10-h2 from 12.1.5–12.1.7-h*), 11.2.16, 11.1.16-h3, 10.2.18-h12.
No workaround fully mitigates the issue; the only interim risk reduction is strict IP-based access control on the management interface plus enabling Threat Prevention signatures 510046 and 510047.
CISA KEV lists this with a remediation due date of 2026-10-17 under BOD 26-04 — prioritize accordingly, and if patching can't be completed, evaluate discontinuing exposed management-interface access per BOD guidance.
Cloud NGFW and Prisma Access are confirmed not impacted — no action needed there.
After patching, monitor firewall logs and Panorama for anomalous admin activity or unexpected process execution, and verify management-interface reachability is still restricted to trusted internal sources.

Technical context

CWE-94 (Code Injection) enabling authenticated, network-based arbitrary code execution with root privileges via the PAN-OS management interface; no user interaction required beyond an existing authenticated session. Confirmed active exploitation — listed in CISA KEV (added 2026-10-14, due 2026-10-17) — and a public exploit is available, placing this at high exploit maturity. No vendor-supported workaround exists; Threat Prevention signatures 510046/510047 offer only limited coverage. Fixed releases: PAN-OS 12.2.4, 12.1.10-h2 (or 12.1.7-h8), 11.2.16, 11.1.16-h3, 10.2.18-h12; Cloud NGFW and Prisma Access are not affected.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS68th

Public exploit

CISA KEV

Listed as exploited in the wild since 2026-10-14.

US federal agencies must remediate by 2026-10-17.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

0 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

1.2% chance of exploitation activity in the next 30 days, which ranks it in the 68th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

17 events over 8 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-10-15Patch availablepatch available, workaround available, workaround available, record updated, record updated
2026-10-14Added to CISA KEVpatch available, patch available, workaround available, workaround available, published, weakness classified, att&ck mapped, record updated, record updated

Affected products

Palo Alto Networkscommercial · USaka pan-os, prisma access, cloud ngfw
paloaltonetworkscommercial · USaka palo alto networks, panw
- pan-osSecurity Products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Scored 7.2 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required HighRequires admin or elevated privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable