CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)

Palo Alto Networks' advisory of 2026-10-14 describes CVE-2026-0322, a code injection (CWE-94) in the management interface of PAN-OS that lets an authenticated attacker with network access run arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected and no special configuration is needed to be affected (Palo Alto Networks PSIRT, 2026-10-14). The advisory is tagged as attacked and says very limited exploitation has been observed targeting the management interface (Palo Alto Networks PSIRT, 2026-10-14), and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day (CISA, 2026-10-14). Palo Alto scores it CVSS-B 8.6 with a suggested urgency of highest, says the risk is highest when the management interface is reachable from the internet, and scores it 8.5 when access is restricted to a single jump box (Palo Alto Networks PSIRT, 2026-10-14). It lists no workaround; Threat Prevention IDs 510046 and 510047 give limited coverage and only when management traffic is routed through a data-plane interface and decrypted, and Palo Alto warns that variations of the attack may not be detected (Palo Alto Networks PSIRT, 2026-10-14). Fixes ship per train, and the 11.2.16 build is listed with an ETA of 2026-10-15, so a unit on 11.2.14 or 11.2.15 had no fixed build when the advisory appeared (Palo Alto Networks PSIRT, 2026-10-14). The advisory does not say how the attackers obtained the credentials the flaw requires, when exploitation began or who is behind it, and BleepingComputer says it asked Palo Alto when exploitation began, who is behind the attacks and whether attackers compromised firewalls or used them to reach internal networks (BleepingComputer, 2026-10-14).