Palo Alto Networks PAN-OS Code Injection Vulnerability

🚨SEVERITY: HIGH — CVSS 8.6Security Advisory

TL;DR 📌

  • Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
  • Highest CVSS: 8.6 (High).
  • Listed in CISA KEV (2026-10-14) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-0322.

What it is

CVE-2026-0322 is a code injection vulnerability in the management interface of PAN-OS. An attacker who already has an authenticated session and network access to that interface can inject code that executes with root privileges on the firewall.

This sits on the management plane, not the data plane — the path to exploitation runs through the PAN-OS management interface rather than through traffic the firewall is inspecting. The vulnerability applies to PAN-OS running on PA-Series and VM-Series firewalls, and on Panorama (both virtual and M-Series). Cloud NGFW and Prisma Access are not affected.

Because exploitation requires authentication, the realistic risk depends heavily on who can reach that interface and with what credentials. Palo Alto Networks’ own guidance notes that the risk is reduced where the management interface is restricted to trusted internal IP addresses, as recommended in their standard deployment practice — i.e. where it isn’t exposed to the wider network or the internet.

The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-10-14.

What to do

  • Check whether the PAN-OS management interface on any PA-Series, VM-Series, or Panorama (virtual or M-Series) deployment is reachable from untrusted networks, and restrict access to trusted internal IP addresses only if it isn’t already.
  • Review who holds valid credentials for management interface access — exploitation requires authentication, so credential hygiene and account review are a direct mitigation here.
  • Consult Palo Alto Networks’ advisory for CVE-2026-0322 for fixed PAN-OS releases, as specific fixed versions are not yet listed; apply them once identified.
  • Given this CVE’s presence in CISA’s KEV catalogue, treat patching and access restriction as time-sensitive rather than routine maintenance.
  • Confirm that Cloud NGFW and Prisma Access deployments do not require action, as they are explicitly stated to be unaffected.

For leadership 🧭

Executive summary. A root-level code execution flaw in the PAN-OS management interface is listed in CISA’s Known Exploited Vulnerabilities catalogue, meaning attackers are actively using it where the interface is reachable with valid credentials. Any PA-Series, VM-Series, or Panorama deployment with the management interface exposed to untrusted networks needs urgent access restriction and credential review, with patching applied as soon as fixed releases are confirmed.

Why it matters:

  • Successful exploitation gives root privileges on the firewall itself, not just a managed device behind it — full control of PA-Series, VM-Series, or Panorama (virtual or M-Series) deployments.
  • The vulnerability is in CISA’s KEV catalogue (added 2026-10-14), indicating confirmed exploitation rather than theoretical risk.
  • Exploitation requires an authenticated session, so any management interface reachable from untrusted networks combined with weak credential hygiene turns this into a practical attack path.
  • Cloud NGFW and Prisma Access are explicitly unaffected, so remediation effort should focus specifically on on-box PAN-OS management interfaces.

Now / Next / Later:

  • Now: Check whether the PAN-OS management interface on any PA-Series, VM-Series, or Panorama deployment is reachable from untrusted networks, and restrict it to trusted internal IP addresses immediately if it is.
  • Next: Review all accounts with valid credentials for management interface access and revoke or rotate any that aren’t strictly needed, as exploitation depends on an authenticated session.
  • Later: Watch Palo Alto Networks’ advisory for fixed PAN-OS releases for CVE-2026-0322 and apply them as soon as they are published, treating this as a scheduled patch rather than optional maintenance given its KEV listing.

Source