Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChighExploited in the wild

CISA adds authenticated PAN-OS root RCE to KEV (CVE-2026-0322)

Original title: CISA KEV: Palo Alto Networks PAN-OS Code Injection Vulnerability — Palo Alto Networks PAN-OS (CVE-2026-0322)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
AI summary · x-ai/grok-4.7Summaries by Vani AI

An authenticated attacker on the management network can run code as root on PA-Series, VM-Series, and Panorama; agencies must act by October 17.

CISA added CVE-2026-0322, a code-injection flaw in the PAN-OS management interface, to the Known Exploited Vulnerabilities catalog. An authenticated attacker with network access can execute arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama, virtual and M-Series. Cloud NGFW and Prisma Access are not affected. The required action date is October 17, 2026; known ransomware use is listed as unknown.

Unconfirmed: The entry lists known ransomware campaign use as unknown and does not describe specific incidents.

Key facts
  • The flaw is in the PAN-OS management interface and yields root code execution.
  • Restricting that interface to trusted internal addresses reduces exposure.
  • Cloud NGFW and Prisma Access are not impacted.
  • Federal stakeholders must follow BOD 26-04 by October 17, 2026.
Security assessment · AI, from the articleExploited in the wild

Impact: Authenticated remote code execution as root on the firewall

ProductAffected
Palo Alto Networks PAN-OS—
Palo Alto Networks Panoramavirtual and M-Series
What to do
  1. 1.Restrict management-interface access to trusted internal IP addresses.
  2. 2.Apply vendor mitigations and meet BOD 26-04 by October 17, 2026.
  3. 3.Follow CISA forensics triage requirements for affected assets.
Analyze CVE-2026-0322 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-0322
ATT&CK
T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting Interpreter
Tags
pan-ospalo-alto-networkskevremote-code-executionfirewall
Vendors
Palo Alto Networks
Products
PAN-OSPanoramaCloud NGFWPrisma Access
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-0322
Authenticated root RCE in Palo Alto PAN-OS management
8.62%KEV
KEV

From the original article

1 min read at cisa.gov

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.