CVE-2026-0322 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-10-14

Added to CISA KEV: 2026-10-14 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

IMMEDIATE (within 24 hours): Audit whether your PAN-OS management interface is reachable from the internet — use 'show system info' and verify management interface IP routing. If internet-exposed, restrict access immediately via Security Profiles or ACLs to trusted jump-box IPs only.
IMMEDIATE (within 24 hours): Review management interface authentication logs for anomalous login attempts, unexpected source IPs, or successful logins from unrecognized locations. Check for unauthorized admin account creation or configuration changes.
CRITICAL PATCHING: Apply vendor-provided patches immediately based on your version: PAN-OS 10.2.x → 10.2.18-h12+; 11.1.x → 11.1.16-h3+; 11.2.x → 11.2.16+; 12.1.x → 12.1.10-h2+; 12.2.x → 12.2.4+. Check specific hotfix branches in the advisory.
THREAT PREVENTION: If patching is delayed, enable Threat IDs 510046 and 510047 (content version 9159-10287+) with SSL decryption enabled on management traffic routed through a DP interface.
ACCESS RESTRICTION WORKAROUND: If immediate patching is not feasible, restrict management interface access to a dedicated jump-box or management VLAN only. Remove all internet-accessible routes to the MGT interface.
CREDENTIAL AUDIT: Given authentication is required for exploitation, audit all management-plane accounts. Disable unused accounts, rotate all management credentials, enforce MFA where supported, and review service accounts.
PANORAMA PRIORITY: Treat Panorama management servers as equal or higher priority than individual firewalls — a Panorama compromise cascades to all managed devices.
MONITORING: Alert on any new administrator account creation, configuration exports, certificate modifications, or management interface login failures/successes from unexpected source IPs.
PATCH PRIORITY LEVEL: CRITICAL — patch within 24-48 hours for internet-exposed management interfaces; within 72 hours for all other deployments. Active exploitation confirmed.

🔍 Web Intelligence (Kagi · 2026-10-14)

Summary

CVE-2026-0322 is a critical remote code execution (RCE) vulnerability affecting the management interface of Palo Alto Networks PAN-OS software, including Cloud NGFW and Prisma Access environments ^[1]^[2]. This vulnerability is highly significant because it allows an authenticated attacker with network access to the management interface to execute arbitrary code with root privileges on the affected firewall, effectively granting complete control over the security appliance ^[1]^[3].

Exploitation

Active Exploitation: While the vulnerability is under active monitoring by security vendors, specific reports of mass exploitation in the wild are evolving; organizations should treat this as a high-priority threat ^[2].
Threat Actors: There are no specific threat actor groups or ransomware campaigns publicly attributed to this vulnerability at this time.
Tool Availability: Proof-of-concept (PoC) code or exploit tools may be circulating in security research communities; defensive teams should assume exploitation capabilities exist.
Attack Prerequisites:

- Authentication: Attackers must have valid administrative or user credentials for the management interface. - Network Access: The attacker must have network-level access to the management interface. - User Interaction: No specific user interaction beyond authentication is required ^[1]^[3].

Affected Products & Patches

Affected Products: Palo Alto Networks PAN-OS software, Cloud NGFW, and Prisma Access.
Patch Availability: Patches are available from Palo Alto Networks; administrators must check the official security advisory for the specific versions corresponding to their deployment and apply the updates immediately ^[1]^[2].
Mitigations: If patching is not immediately feasible, restrict access to the management interface to trusted internal IP addresses only and ensure the interface is not exposed to the public internet ^[2].

Impact

System Access: Successful exploitation provides the attacker with root-level access to the firewall, allowing for full system compromise, configuration modification, and data exfiltration.
Business Risk: For internet-facing deployments, this vulnerability presents a severe business risk, as the firewall—typically the primary defensive perimeter—can be turned against the organization's own network, leading to a complete bypass of security policies, lateral movement within the network, and the potential for long-term persistence by malicious actors ^[1]^[3].

Sources

CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the ...
Palo Alto Networks Security Advisory: CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to ex…
CVE-2026-0322: Palo Alto Networks Remote Code Execution | CVETodo
CVE-2026-0322: Remote Code Execution in Cloud NGFW, PAN-OS, Prisma Access. Includes technical details, affected versions, and mitigation steps.
CVE-2026-0322: PAN-OS Code Injection (CVSS 8.6) — Fix & Details
CVE-2026-0322 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the fi…

🟡 CVE-2026-0322