---
schema: 1
kind: vulnerability
title: "CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)"
headline: "Palo Alto confirms limited exploitation of a PAN-OS management-interface root flaw; no workaround, 11.2.16 due 15 Oct"
summary: >
  Palo Alto Networks' advisory of 2026-10-14 fixes CVE-2026-0322, a code injection in the PAN-OS management interface that lets an authenticated attacker with network access
  run code as root on PA-Series and VM-Series firewalls and on Panorama; the advisory is tagged as attacked and reports very limited exploitation, and CISA listed the flaw in KEV the same day.
  There is no workaround, the risk is highest where the management interface is reachable from the internet, and the 11.2.16 build is listed with an ETA of 2026-10-15, so units on 11.2.14 and 11.2.15 had no fixed build at publication.
discovered_at: "2026-10-15T03:41:00Z"
updated_at: null
event_date: "2026-10-14"
run_id: 2026-10-15T0256Z-intel
priority: high
immediate_action: null
tags: [vulnerabilities, actively-exploited, rce, cisa-kev, patch-available]
regions: [global]
sectors: [public-sector, technology]
entities: ["product:palo-alto-networks-pan-os", "product:palo-alto-networks-panorama"]
techniques: [T1190]
affected_products: ["Palo Alto Networks PAN-OS", "Palo Alto Networks Panorama"]
cves:
  - id: CVE-2026-0322
    cvss: "8.6"
    epss: null
    type: rce
    vector: zero-click
    auth: post-auth
    status: [exploited, cisa-kev, patch-available]
    affected: "PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 below the fixed builds, on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected"
    fixed: "12.2.4; 12.1.4-h12, 12.1.7-h8, 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16 (ETA 2026-10-15; the fix for 11.2.14 and 11.2.15); 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3; 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; no workaround"
sources:
  - url: "https://security.paloaltonetworks.com/CVE-2026-0322"
    publisher: "Palo Alto Networks PSIRT"
    date: "2026-10-14"
    role: primary
  - url: "https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/"
    publisher: "BleepingComputer"
    date: "2026-10-14"
    role: corroborating
  - url: "https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog"
    publisher: "CISA"
    date: "2026-10-14"
    role: corroborating
closed_sources: []
evidence:
  - quote: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface."
    publisher: "Palo Alto Networks PSIRT"
    source_url: "https://security.paloaltonetworks.com/CVE-2026-0322"
  - quote: "No known workarounds exist for this issue."
    publisher: "Palo Alto Networks PSIRT"
    source_url: "https://security.paloaltonetworks.com/CVE-2026-0322"
  - quote: "The risk is highest when you allow access to the management interface from external IP addresses on the internet."
    publisher: "Palo Alto Networks PSIRT"
    source_url: "https://security.paloaltonetworks.com/CVE-2026-0322"
verification: multi-source
sourcing_note: >
  The exploitation status, the affected products and the fixed builds come from Palo Alto Networks' own advisory; BleepingComputer restates it and CISA's alert confirms the KEV listing.
  No source says how the attackers obtained the credentials the flaw requires, when exploitation began or who is behind it.
confidence: high
references:
  - 2026-05-30/cve-2026-0257-palo-alto-pan-os-globalprotect-pre-auth-authen
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Restrict the management interface of every PA-Series, VM-Series and Panorama to a jump box or trusted internal addresses now, then upgrade each to the fixed build of its train (11.2.14 and 11.2.15 units to 11.2.16, listed with an ETA of 2026-10-15); there is no workaround."
  - "On every device whose management interface was reachable from untrusted networks, search management-interface logins, administrator-change records and upstream firewall logs for the three source addresses Palo Alto lists in the advisory's FAQ, and treat a match as a root compromise."
updates: []
migrated_from: null
---

Palo Alto Networks' advisory of 2026-10-14 describes CVE-2026-0322, a code injection (CWE-94) in the management interface of PAN-OS that lets an authenticated attacker with network access run arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected and no special configuration is needed to be affected ([Palo Alto Networks PSIRT, 2026-10-14](https://security.paloaltonetworks.com/CVE-2026-0322)). The advisory is tagged as attacked and says very limited exploitation has been observed targeting the management interface ([Palo Alto Networks PSIRT, 2026-10-14](https://security.paloaltonetworks.com/CVE-2026-0322)), and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day ([CISA, 2026-10-14](https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog)). Palo Alto scores it CVSS-B 8.6 with a suggested urgency of highest, says the risk is highest when the management interface is reachable from the internet, and scores it 8.5 when access is restricted to a single jump box ([Palo Alto Networks PSIRT, 2026-10-14](https://security.paloaltonetworks.com/CVE-2026-0322)). It lists no workaround; Threat Prevention IDs 510046 and 510047 give limited coverage and only when management traffic is routed through a data-plane interface and decrypted, and Palo Alto warns that variations of the attack may not be detected ([Palo Alto Networks PSIRT, 2026-10-14](https://security.paloaltonetworks.com/CVE-2026-0322)). Fixes ship per train, and the 11.2.16 build is listed with an ETA of 2026-10-15, so a unit on 11.2.14 or 11.2.15 had no fixed build when the advisory appeared ([Palo Alto Networks PSIRT, 2026-10-14](https://security.paloaltonetworks.com/CVE-2026-0322)). The advisory does not say how the attackers obtained the credentials the flaw requires, when exploitation began or who is behind it, and BleepingComputer says it asked Palo Alto when exploitation began, who is behind the attacks and whether attackers compromised firewalls or used them to reach internal networks ([BleepingComputer, 2026-10-14](https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/)).

**Exposure:** any PA-Series or VM-Series firewall or Panorama (virtual or M-Series) on PAN-OS 10.2, 11.1, 11.2, 12.1 or 12.2 below the fixed build of its train, with no configuration needed; the exposure is greatest where the management interface accepts connections from outside trusted internal addresses ([Palo Alto Networks PSIRT, 2026-10-14](https://security.paloaltonetworks.com/CVE-2026-0322)). BleepingComputer reads the advisory as requiring existing credentials and network access to the management interface ([BleepingComputer, 2026-10-14](https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/)).

**Detection:** look at authentication and administrator-change records on the management interface, and at inbound connections to the management address in upstream firewall or provider logs, for logins from unfamiliar sources; Palo Alto's advisory FAQ lists three source addresses associated with the limited exploit attempts to compare against ([Palo Alto Networks PSIRT, 2026-10-14](https://security.paloaltonetworks.com/CVE-2026-0322)). Root code execution means an upgrade does not evict an attacker who is already in, and the advisory gives no file or process artifact, so a device that was reachable from untrusted networks before the fix needs a compromise assessment as well as the patch.

**Defender takeaway:** take the management interface off every network but trusted internal addresses, with a jump box as the tightest setting Palo Alto describes, and upgrade to the fixed build of each train; units on 11.2.14 and 11.2.15 wait for 11.2.16, which Palo Alto lists with an ETA of 2026-10-15, so confirm the build is out before scheduling them ([Palo Alto Networks PSIRT, 2026-10-14](https://security.paloaltonetworks.com/CVE-2026-0322)).