Palo Alto Networks PAN-OS
CVE-2026-0322: code injection in the PAN-OS management interface.
A remote code execution flaw in the management interface of Palo Alto Networks PAN-OS lets an authenticated attacker with network access to that interface run code as root on the firewall. CISA lists it as exploited.
Exploitation
- Exploitation
- Exploited in the wild
- CISA KEV
- Listed 14 Oct 2026
- Federal due date 17 Oct 2026; catalogue read 31 Oct 2026
- EPSS
- 1.7% in 30 days
- Percentile 78%, scored 29 Oct 2026
- 8.6High, (CVSS 4.0)Scored by NVD
- 1.7%EPSS, chance of exploitation in 30 daysPercentile 78%; scored 29 Oct 2026
- 14 OctPublished by NVD14 Oct 2026; record read 15 Oct 2026
Versions
Affected and fixed.
.
| Affected | Fixed in |
|---|---|
| PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 before the fixed builds, on PA-Series, VM-Series and Panorama | PAN-OS 12.2.4 and the hotfix builds in the vendor advisory |
What to do now
Patch to a fixed PAN-OS build and restrict management access to trusted internal addresses. The steps for all three products in the release sit in our advisory.
How to check exposure
The running PAN-OS version prints on the firewall's dashboard and in the device summary in Panorama. The flaw applies to PA-Series and VM-Series firewalls and to Panorama, virtual and M-Series, on the 10.2, 11.1, 11.2, 12.1 and 12.2 branches before the fixed builds.
The Palo Alto Networks advisory for CVE-2026-0322, opens in a new tab names each hotfix. The exposure check that matters most is where the management interface answers from: if it is reachable from the internet or from the general office network, the flaw is one stolen admin credential from root.
Who this reaches in Australia
PAN-OS firewalls sit at the perimeter of Australian state agencies, hospitals, universities and larger professional firms, and Panorama manages fleets of them. A root shell on the firewall is a position on every network segment it joins.
Under the Essential Eight the fix is patch operating systems for an internet-facing network device: 48 hours where a working exploit exists. Restrict administrative privileges covers the second half, the admin accounts that can reach the management interface.
Timeline
Disclosed, published, listed, advised.
- : Published by NVD
- : Added to the CISA Known Exploited Vulnerabilities Catalog
- : NVD record last modified
- : CISA due date for US federal agencies
Questions, answered.
Does CVE-2026-0322 need credentials?
Yes. The attacker needs an authenticated session on the management interface and network access to it. The management interface restricted to trusted internal addresses, as the vendor recommends, removes most of the exposure while the patch lands.
Which PAN-OS versions are affected?
PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 before the fixed builds, on PA-Series and VM-Series firewalls and on Panorama. Cloud NGFW and Prisma Access are not affected according to the vendor's advisory.
What does the catalogue listing mean for an Australian firm?
The CISA due date binds US federal agencies only. For an Australian organisation it is the clearest public signal that exploitation is confirmed, which puts the patch inside the 48 hour window of the Essential Eight.
Provenance
Sources, and when they were read.
Every source was read 31 Oct 2026.
- 1NVD, CVE-2026-0322NIST. US Government work, public domain.
- 2CISA, Known Exploited Vulnerabilities CatalogUS Government work, public domain.
- 3FIRST, EPSS score for CVE-2026-0322EPSS terms of use.
- 4Black Shard, Essential Eight assessment
- 5Black Shard, CISA lists exploited flaws in PAN-OS, Cisco Secure Email Gateway and AhsayCBS
- 6Vendor reference for CVE-2026-0322: security.paloaltonetworks.compaloaltonetworks.com. terms of use.