Palo Alto Networks (PAN-OS) Remote Code Execution Vulnerability Exploited in Attack (CVE-2026-0322)
Attackers are exploiting CVE-2026-0322, an authenticated PAN-OS flaw that enables root code execution.
Threat actors are exploiting CVE-2026-0322, a high-severity flaw in the PAN-OS management interface. An authenticated attacker with network access can execute arbitrary code with root privileges on the firewall. Palo Alto says exploitation has been very limited, and CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog, urging patches before October 17, 2026. Fixes are available across PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 branches.
- CVE-2026-0322 lets authenticated attackers execute code as root on PAN-OS.
- Palo Alto reports very limited exploitation of the management interface.
- CISA added it to the KEV catalog with an October 17, 2026 deadline.
- Affected branches include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2.
- Qualys QID 735740 detects vulnerable assets.
Vulnerabilities mentionedAll →
- CVE-2026-03228.61%Authenticated root RCE in Palo Alto PAN-OS managementpublished · Palo Alto Networks PAN-OS on PA-Series firewalls KEV
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-0322 | Authenticated root RCE in Palo Alto PAN-OS management CVE-2026-0322 is a code-injection flaw (CWE-94) in the management interface of Palo Alto Networks PAN-OS that allows remote code execution. An authenticated attacker who can reach the management interface over the network can run arbitrary code with root privileges on the device. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. Palo Alto notes that risk is reduced when management access is limited to trusted internal addresses, consistent with its deployment guidance. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-10-14, and reporting describes active exploitation including as a zero-day; ransomware use is listed as unknown and no public proof-of-concept is known. CVSS 4.0 is 8.6 (high), with high privileges required but low attack complexity and full impact on the vulnerable system. |
Full article331 words · extracted from threatprotect.qualys.com · click to collapse
Threat actors are exploiting a high-severity PAN-OS vulnerability, tracked as CVE-2026-0322. The vulnerability exists in the management interface of Palo Alto Networks PAN-OS software. Successful exploitation of the vulnerability may allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Palo Alto mentioned in their advisory that very limited exploitation has been observed targeting its management interface.
CISA acknowledged the active exploitation of the vulnerability by adding it to its Known Exploited Vulnerabilities Catalog. CISA urged users to patch it before October 17, 2026.
Affected and Patched Versions
| Product | Affected Version | Patched Version |
| PAN-OS 12.2 | < 12.2.4 | Upgrade to 12.2.4 or later. |
| PAN-OS 12.1 | < 12.1.4-h12 < 12.1.7-h8 < 12.1.10-h2 |
Upgrade to 12.1.10-h2 or later.
Upgrade to 12.1.7-h8 or 12.1.10-h2 or later. Upgrade to 12.1.4-h12 or 12.1.10-h2 or later. |
| PAN-OS 11.2 | < 11.2.4-h22 < 11.2.7-h21 < 11.2.10-h15 < 11.2.13-h3 < 11.2.16 |
Upgrade to 11.2.16 or later.
Upgrade to 11.2.13-h3 or 11.2.16 or later. Upgrade to 11.2.10-h15 or 11.2.16 or later. Upgrade to 11.2.7-h21 or 11.2.16 or later. Upgrade to 11.2.4-h22 or 11.2.16 or later. |
| PAN-OS 11.1 | < 11.1.4-h37 < 11.1.6-h39 < 11.1.7-h11 < 11.1.10-h35 < 11.1.13-h15 < 11.1.16-h3 |
Upgrade to 11.1.16-h3 or later.
Upgrade to 11.1.13-h15 or 11.1.16-h3 or later. Upgrade to 11.1.10-h35 or 11.1.16-h3 or later. Upgrade to 11.1.7-h11 or 11.1.16-h3 or later. Upgrade to 11.1.6-h39 or 11.1.16-h3 or later. Upgrade to 11.1.4-h37 or 11.1.16-h3 or later. |
| PAN-OS 10.2 | < 10.2.7-h38 < 10.2.10-h41 < 10.2.13-h26 < 10.2.16-h11 < 10.2.18-h12 |
Upgrade to 10.2.18-h12 or later.
Upgrade to 10.2.16-h11 or 10.2.18-h12 or later. Upgrade to 10.2.13-h26 or 10.2.18-h12 or later. Upgrade to 10.2.10-h41 or 10.2.18-h12 or later. Upgrade to 10.2.7-h38 or 10.2.18-h12 or later. |
Users can refer to the Palo Alto Networks Security Advisory for information regarding patching this vulnerability.
Qualys Detection
Qualys customers can scan their devices with QID 735740 to detect vulnerable assets.
Please continue to follow Qualys Threat Protection for more coverage on the latest vulnerabilities.
References
https://security.paloaltonetworks.com/CVE-2026-0322