CVE-2026-0322 is a code-injection flaw (CWE-94) in the management interface of Palo Alto Networks PAN-OS that allows remote code execution. An authenticated attacker who can reach the management interface over the network can run arbitrary code with root privileges on the device. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. Palo Alto notes that risk is reduced when management access is limited to trusted internal addresses, consistent with its deployment guidance. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-10-14, and reporting describes active exploitation including as a zero-day; ransomware use is listed as unknown and no public proof-of-concept is known. CVSS 4.0 is 8.6 (high), with high privileges required but low attack complexity and full impact on the vulnerable system.
What to do: Restrict PAN-OS and Panorama management interfaces to trusted internal IP addresses only, and apply Palo Alto Networks patches per vendor guidance and CISA BOD 26-04. Because this is in the CISA KEV catalog with reported active exploitation, review management-plane access logs and host integrity for unexpected root-level activity, and follow CISA forensics triage requirements where the interface was reachable.
Affected
Palo Alto Networks PAN-OS on PA-Series firewalls
—
Palo Alto Networks PAN-OS on VM-Series firewalls
—
Palo Alto Networks Panorama (virtual and M-Series)
—
Estimated exposure
largeon the order of 10,000–100,000+ PAN-OS and Panorama installations, with far fewer if management access is limited to trusted networks — PAN-OS on PA-Series, VM-Series, and Panorama is a widely deployed enterprise firewall and management platform, so affected installations are plausibly in the tens to low hundreds of thousands; internet-exposed management interfaces are a…
Description
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
CISA Known Exploited Vulnerability
Affected
Palo Alto Networks PAN-OS
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA added exploited Palo Alto, Cisco, and Ahsay flaws to KEV, with a three-day federal deadline.
CISA added four actively exploited vulnerabilities to the KEV catalog and gave U.S. federal civilian agencies until October 17, 2026, to remediate them. CVE-2026-0322 is an authenticated PAN-OS management-interface flaw, CVSS 8.6, that yields root code execution on PA-Series, VM-Series, and Panorama; Palo Alto reports very limited exploitation. CVE-2026-76519 is a CVSS 9.8 path-traversal bug in Cisco Secure Email Gateway’s AMP file-reputation feature that lets a crafted attachment write files and run commands as root. CVE-2026-105133 and CVE-2026-105134 in AhsayCBS are chained for authentication bypass and SYSTEM-level command injection; Huntress observed webshells and cryptominers, and Ahsay said earlier patches were incomplete.
CISA added actively exploited Palo Alto PAN-OS, Cisco email gateway, and AhsayCBS flaws to the KEV catalog.
CISA added four actively exploited flaws to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to fix them by October 17, 2026. CVE-2026-76519 (CVSS 9.8) is a relative path traversal in Cisco Secure Email Gateway that Cisco says is exploited by crafted email attachments that write arbitrary files. CVE-2026-0322 (CVSS 8.6) is authenticated code injection in the PAN-OS management interface, with limited exploitation observed on PA-Series, VM-Series, and Panorama. AhsayCBS flaws CVE-2026-105133 and CVE-2026-105134 were chained from October 7 for authentication bypass and unauthenticated command injection, deploying JSP webshells and XMRig miners against at least five organizations.
Cisco and Palo Alto patched two actively exploited zero-days enabling root code execution on email and PAN-OS appliances.
Cisco and Palo Alto Networks patched two actively exploited zero-days that can lead to root-level code execution on security appliances, and CISA added both to the KEV catalog. CVE-2026-76519 in Cisco Secure Email Gateway can be exploited remotely without authentication through malicious email attachments. CVE-2026-0322 in the PAN-OS management interface requires network access and valid high-privilege credentials. Both need urgent remediation, but their exposure conditions differ.
Palo Alto says attackers are exploiting CVE-2026-0322, an authenticated PAN-OS management RCE that yields root.
Palo Alto Networks warned that attackers are exploiting CVE-2026-0322, a high-severity code-injection flaw in the PAN-OS management interface. An authenticated attacker with network access can run arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama; Cloud NGFW and Prisma Access are not affected. CVSS 4.0 reaches 8.6 when the interface is network-reachable and 8.5 from an adjacent network, and the vendor has seen very limited exploitation. There is no workaround; customers should patch, block internet access to management, rotate administrator credentials, and review logs.
Palo Alto patched PAN-OS zero-day CVE-2026-0322 after limited exploitation for root remote code execution.
Palo Alto Networks patched CVE-2026-0322, a high-severity PAN-OS zero-day in the management interface that lets an authenticated attacker with network access run arbitrary code as root. It affects PAN-OS on PA-Series and VM-Series firewalls and Panorama, with no special configuration required. The company said very limited exploitation was observed, released related IP indicators, and did not name an actor. CISA added the flaw to the Known Exploited Vulnerabilities catalog and ordered federal agencies to remediate by October 17.
Palo Alto says attackers are exploiting PAN-OS RCE CVE-2026-0322, which CISA added to KEV.
Palo Alto Networks patched CVE-2026-0322, a high-severity PAN-OS remote code execution flaw in the management interface that lets authenticated attackers with network access run code as root. The company said exploitation has been very limited and listed source IPs 66.42.72.14, 208.83.239.114, and 149.248.47.234. Affected products include PA-Series and VM-Series firewalls and Panorama appliances on PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2; Cloud NGFW and Prisma Access are not affected. CISA added the CVE to the Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to mitigate it by October 17.
Attackers are exploiting PAN-OS CVE-2026-0322 for root access; CISA set a three-day fix.
Palo Alto Networks disclosed CVE-2026-0322 on 14 October, a code-injection flaw that lets an authenticated attacker with network access run arbitrary code as root on PAN-OS firewalls and Panorama. The company rated it 8.6 on CVSS 4.0 and said very limited exploitation has targeted the management interface. CISA added the flaw to the Known Exploited Vulnerabilities catalog the same day and ordered US federal agencies to mitigate it and check for compromise by 17 October. Fixed releases cover PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2; Cloud NGFW and Prisma Access are unaffected, and no workaround exists.
Palo Alto patches exploited PAN-OS management RCE CVE-2026-0322; CISA set an October 17 deadline.
Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), an authenticated remote code execution flaw in the PAN-OS management interface that lets an attacker with network access run code as root. PA-Series, VM-Series, and Panorama are affected; Cloud NGFW and Prisma Access are not. The company said exploitation has been very limited and tied attempts to three U.S. IP addresses. CISA added CVE-2026-0322 and Cisco Secure Email Gateway flaw CVE-2026-76519 to KEV, with a federal patch deadline of October 17, 2026.
CISA added four actively exploited flaws in PAN-OS, Cisco Secure Email Gateway, and AhsayCBS to KEV.
CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. They are CVE-2026-0322, a Palo Alto Networks PAN-OS code injection flaw; CVE-2026-76519, a Cisco Secure Email Gateway relative path traversal flaw; and CVE-2026-105133 and CVE-2026-105134, improper authentication and command injection in Ahsay AhsayCBS. Binding Operational Directive 26-04 requires federal civilian agencies to prioritize remediation of KEV entries, especially on exposed assets that can be fully controlled after exploitation.
CISA added PAN-OS code injection flaw CVE-2026-0322 to the KEV catalog after real-world attacks; federal agencies must mitigate by October 17.
CISA added CVE-2026-0322, a high-severity authenticated code injection flaw (CWE-94, CVSS 4.0 score 8.6) in the PAN-OS management interface, to its Known Exploited Vulnerabilities catalog on October 14, with an October 17 remediation deadline for federal civilian agencies under BOD 26-04. The flaw allows authenticated attackers to execute arbitrary code with root privileges on PA-Series, VM-Series, Panorama, and M-Series appliances, while Cloud NGFW and Prisma Access are unaffected. Palo Alto Networks reported very limited exploitation attempts, sharing three related IP addresses, and released fixes across PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 branches.
Attackers are exploiting CVE-2026-0322, an authenticated PAN-OS flaw that enables root code execution.
Threat actors are exploiting CVE-2026-0322, a high-severity flaw in the PAN-OS management interface. An authenticated attacker with network access can execute arbitrary code with root privileges on the firewall. Palo Alto says exploitation has been very limited, and CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog, urging patches before October 17, 2026. Fixes are available across PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 branches.
Attackers are exploiting PAN-OS CVE-2026-0322 for limited root code execution through the management interface.
Palo Alto Networks says attackers are exploiting CVE-2026-0322, a PAN-OS code-injection flaw that lets an authenticated, highly privileged user execute code as root through the management interface. The issue has a CVSS 4.0 score of 8.6, and the company reported very limited exploitation without naming attackers or victim counts. PA-Series, VM-Series, and Panorama are affected; Cloud NGFW and Prisma Access are not. Fixed releases include PAN-OS 12.2.4, 12.1.10-h2, 11.1.16-h3, and 10.2.18-h12, and Palo Alto linked exploit attempts to 66.42.72.14, 208.83.239.114, and 149.248.47.234.
Canada’s Cyber Centre urges patches for PAN-OS and Prisma Browser, including authenticated RCE CVE-2026-0322.
On October 14, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1041 on Palo Alto Networks PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, plus Prisma Browser before 152.8.5.83. It flags CVE-2026-0322, an authenticated remote code execution flaw in the PAN-OS management interface under PAN-SA-2026-0013, and a Chromium monthly update. Administrators are told to review Palo Alto advisories and apply updates. No exploitation in the wild is stated.