CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Palo Alto Networks PAN-OS management-interface code injection: authenticated attacker gets root, very limited exploitation, CISA KEV-listed (CVSS-B 8.6); fixed per train, 11.2.16 ETA 2026-10-15 (2026-10-14)

cve · CVE-2026-0322

Coverage
1
first 2026-10-15 → last 2026-10-15
Latest activity
2026-10-15
Palo Alto confirms limited exploitation of a PAN-OS management-interface root flaw; no workaround, 11.2.16…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector, technology
Sources cited
3
3 hosts

Action items (2)

Do-now tasks recorded on the entries about CVE-2026-0322, newest first. Check the date before acting on an older one.

  • Restrict the management interface of every PA-Series, VM-Series and Panorama to a jump box or trusted internal addresses now, then upgrade each to the fixed build of its train (11.2.14 and 11.2.15 units to 11.2.16, listed with an ETA of 2026-10-15); there is no workaround.
    2026-10-15CVE-2026-0322
  • On every device whose management interface was reachable from untrusted networks, search management-interface logins, administrator-change records and upstream firewall logs for the three source addresses Palo Alto lists in the advisory's FAQ, and treat a match as a root compromise.
    2026-10-15CVE-2026-0322

Defender insights

What each entry about CVE-2026-0322 tells a defender to do, newest first.

2026-10-15HIGHexploitedPalo Alto confirms limited exploitation of a PAN-OS management-interface root flaw; no workaround, 11.2.16 due 15 Oct

Exposure · detection

Story timeline

  1. 2026-10-15CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)
    trending-vulnerabilitiesPalo Alto confirms limited exploitation of a PAN-OS management-interface root flaw; no workaround, 11.2.16 due 15 Oct

Hunting pivots

Affected products
Palo Alto Networks PAN-OSPalo Alto Networks Panorama
Tags
actively-exploitedcisa-kevpatch-availablercevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-15/cve-2026-0322-pan-os-management-interface-code-injection · ATT&CK page ↗

Entries about Palo Alto Networks PAN-OS management-interface code injection: authenticated attacker gets root, very limited exploitation, CISA KEV-listed (CVSS-B 8.6); fixed per train, 11.2.16 ETA 2026-10-15 (2026-10-14) (1)

2026-10-15 · view entry permalink →

HIGHCVE-2026-0322exploitedNATOA2

CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)

Palo Alto Networks' advisory of 2026-10-14 describes CVE-2026-0322, a code injection (CWE-94) in the management interface of PAN-OS that lets an authenticated attacker with network access run arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected and no special configuration is needed to be affected (Palo Alto Networks PSIRT, 2026-10-14). The advisory is tagged as attacked and says very limited exploitation has been observed targeting the management interface (Palo Alto Networks PSIRT, 2026-10-14), and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-10-14). Palo Alto scores it CVSS-B 8.6 with a suggested urgency of highest, says the risk is highest when the management interface is reachable from the internet, and scores it 8.5 when access is restricted to a single jump box (Palo Alto Networks PSIRT, 2026-10-14). It lists no workaround; Threat Prevention IDs 510046 and 510047 give limited coverage and only when management traffic is routed through a data-plane interface and decrypted, and Palo Alto warns that variations of the attack may not be detected (Palo Alto Networks PSIRT, 2026-10-14). Fixes ship per train, and the 11.2.16 build is listed with an ETA of 2026-10-15, so a unit on 11.2.14 or 11.2.15 had no fixed build when the advisory appeared (Palo Alto Networks PSIRT, 2026-10-14). The advisory does not say how the attackers obtained the credentials the flaw requires, when exploitation began or who is behind it, and BleepingComputer says it asked Palo Alto when exploitation began, who is behind the attacks and whether attackers compromised firewalls or used them to reach internal networks (BleepingComputer, 2026-10-14).

Very limited exploitation has been observed targeting the Palo Alto Networks management interface.

No known workarounds exist for this issue.

The risk is highest when you allow access to the management interface from external IP addresses on the internet.

Palo Alto Networks PSIRT 2026-10-14

Builds on: CISA marks the exploited GlobalProtect VPN bypass as used in ransomware; Arctic Wolf traced…

vulnerability15 Oct 03:41Zmulti-sourceOpen finding →
Sources: Palo Alto Networks PSIRT · BleepingComputer · CISA

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (33%)
  • cisa.gov1 (33%)
  • security.paloaltonetworks.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)