Palo Alto Networks security advisory (AV26-1041)
Canada’s Cyber Centre urges patches for PAN-OS and Prisma Browser, including authenticated RCE CVE-2026-0322.
On October 14, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1041 on Palo Alto Networks PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, plus Prisma Browser before 152.8.5.83. It flags CVE-2026-0322, an authenticated remote code execution flaw in the PAN-OS management interface under PAN-SA-2026-0013, and a Chromium monthly update. Administrators are told to review Palo Alto advisories and apply updates. No exploitation in the wild is stated.
- CVE-2026-0322 is authenticated remote code execution in the PAN-OS management interface.
- Listed branches include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2.
- Prisma Browser before 152.8.5.83 is also affected.
- The bulletin does not report active exploitation.
Vulnerabilities mentionedAll →
- CVE-2026-03228.61%Authenticated root RCE in Palo Alto PAN-OS managementpublished · Palo Alto Networks PAN-OS on PA-Series firewalls KEV
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-0322 | Authenticated root RCE in Palo Alto PAN-OS management CVE-2026-0322 is a code-injection flaw (CWE-94) in the management interface of Palo Alto Networks PAN-OS that allows remote code execution. An authenticated attacker who can reach the management interface over the network can run arbitrary code with root privileges on the device. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected. Palo Alto notes that risk is reduced when management access is limited to trusted internal addresses, consistent with its deployment guidance. CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-10-14, and reporting describes active exploitation including as a zero-day; ransomware use is listed as unknown and no public proof-of-concept is known. CVSS 4.0 is 8.6 (high), with high privileges required but low attack complexity and full impact on the vulnerable system. |
Full article111 words · extracted from cyber.gc.ca · click to collapse
Serial number: AV26-1041
Date: October 14, 2026
As of October 14, 2026, Palo Alto Networks is affected by vulnerabilities in the following products:
- PAN-OS 12.2
- Prior to 12.2.4
- PAN-OS 12.1
- Prior to 12.1.4-h12
- Prior to 12.1.7-h8
- Prior to 12.1.10-h2
- PAN-OS 11.2
- Prior to 11.2.4-h22
- Prior to 11.2.7-h21
- Prior to 11.2.10-h15
- Prior to 11.2.13-h3
- PAN-OS 11.1
- Multiple versions
- PAN-OS 10.2
- Multiple versions
- Prisma Browser
- Prior to 152.8.5.83
The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyber.gc.ca/en/alerts-advisories/palo-alto-networks-security-advisory-av26-1041