Palo Alto Warns of PAN-OS 0-day Flaw Actively Exploited in Attacks
Palo Alto says attackers are exploiting CVE-2026-0322, an authenticated PAN-OS management RCE that yields root.
Palo Alto Networks warned that attackers are exploiting CVE-2026-0322, a high-severity code-injection flaw in the PAN-OS management interface. An authenticated attacker with network access can run arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama; Cloud NGFW and Prisma Access are not affected. CVSS 4.0 reaches 8.6 when the interface is network-reachable and 8.5 from an adjacent network, and the vendor has seen very limited exploitation. There is no workaround; customers should patch, block internet access to management, rotate administrator credentials, and review logs.
- CVE-2026-0322 is an authenticated code-injection bug in the PAN-OS management interface.
- Successful exploitation runs arbitrary code as root; no special configuration is required.
- Palo Alto reports very limited exploitation, with highest risk on internet-exposed management.
- Cloud NGFW and Prisma Access are unaffected; no workaround exists, so patch and restrict access.
- Threat IDs 510046 and 510047 offer limited coverage only with decryption and data-plane routing.
Vulnerabilities mentionedAll →
- CVE-2026-03228.61%Authenticated root RCE in Palo Alto PAN-OS managementpublished · Palo Alto Networks PAN-OS on PA-Series firewalls KEV
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-0322 | Authenticated root RCE in Palo Alto PAN-OS management CVE-2026-0322 is a code-injection flaw (CWE-94) in the management interface of Palo Alto Networks PAN-OS that allows remote code execution. An authenticated attacker who can reach the management interface over the network can run arbitrary code with root privileges on the device. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. Palo Alto notes that risk is reduced when management access is limited to trusted internal addresses, consistent with its deployment guidance. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-10-14, and reporting describes active exploitation including as a zero-day; ransomware use is listed as unknown and no public proof-of-concept is known. CVSS 4.0 is 8.6 (high), with high privileges required but low attack complexity and full impact on the vulnerable system. |
Full article468 words · extracted from gbhackers.com · click to collapse
Palo Alto Networks has warned that attackers are exploiting a high-severity remote code execution flaw in the PAN-OS management interface.
Tracked as CVE-2026-0322, the bug lets an authenticated attacker with network access run arbitrary code with root privileges on the firewall.
PAN-OS zero-day vulnerability
The flaw is a code injection weakness (CWE-94, CAPEC-242) in the PAN-OS management interface. It affects PAN-OS on PA-Series and VM-Series firewalls, and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected.
No special configuration is needed to be vulnerable. Palo Alto rates the severity High and the suggested urgency Highest.
The CVSS 4.0 score depends on exposure, reaching 8.6 (CVSS-B and CVSS-BT) when the management interface is reachable over the network, including from the internet, and 8.5 (CVSS-B and CVSS-BT) when access is limited to an adjacent network, such as through a jump box. Both vectors require high privileges and no user interaction.
Both rate confidentiality, integrity and availability impact as high. The temporal metrics reflect that exploit code is active.
According to the advisory published by Palo Alto Networks, the vendor has seen “very limited exploitation” targeting the management interface. The risk is highest when the interface is reachable from external IP addresses.
The company says exposure is much lower if access is restricted to trusted internal IPs, as its best-practice deployment guidelines recommend.
Because exploitation requires authentication, attackers probably need stolen or weak credentials, or a separate authentication bypass. That makes an internet-facing management interface especially dangerous.
Administrators should upgrade to the fixed hotfix in their current minor train, or to the latest listed release. Unsupported older PAN-OS versions have no patch, so they must move to a supported fixed version.
Palo Alto says no workarounds exist. Customers with a Threat Prevention subscription get limited coverage by enabling Threat IDs 510046 and 510047 (Applications and Threats content version 9159-10287 or later).
The signatures only work if administrators route incoming MGT port traffic through a data-plane (DP) port, for example by enabling a management profile on a DP interface, replace the certificate used for inbound management traffic, decrypt inbound traffic to the management interface so the firewall can inspect it, and enable threat prevention on inbound traffic to management services. The Threat IDs require SSL decryption to work.
Recommended actions include blocking internet access to the management interface now and allowing only trusted internal IPs or a hardened jump box, patching affected firewalls and Panorama appliances as a priority, rotating administrator credentials and reviewing accounts for unauthorized additions, reviewing management logs for unusual logins, configuration changes, or unexpected processes, and treating any exposed device as potentially compromised until it has been checked.
Edge devices like firewalls remain high-value targets. Management-plane exposure has driven many past PAN-OS compromises, so defenders should treat this advisory as urgent.