Palo Alto PAN-OS: a management interface flaw gives root on firewalls, already exploited

Palo Alto Networks has fixed CVE-2026-0322, a flaw in the PAN-OS management interface that lets an authenticated administrator run code as root on PA-Series and VM-Series firewalls and on Panorama. The vendor has observed limited exploitation, and CISA gave US agencies until 17 October to act.

What happened

On 14 October 2026, Palo Alto Networks published an advisory for CVE-2026-0322 (CVSS 4.0: 8.6), a code injection flaw in the web management interface of PAN-OS. An attacker who can reach that interface and holds an account with high privileges can execute arbitrary code with root rights on the device. The vendor says it has seen very limited exploitation and lists three IP addresses linked to the attacks. CISA added the flaw to its catalogue of exploited vulnerabilities the same day, with a deadline of 17 October for US federal agencies, and CERT-FR relayed the alert on 15 October.

Who is affected

PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) running PAN-OS 10.2, 11.1, 11.2, 12.1 or 12.2 before the fixed releases. Cloud NGFW and Prisma Access are not affected. A login is required, but stolen or reused administrator passwords are common on firewalls whose management page is reachable from the internet.

What to do now

1. Check the version with show system info on the CLI, then compare it with the vendor table.
2. Upgrade: 12.2.4; 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 or 11.2.16; 11.1.16-h3 or the hotfix listed for your 11.1 release; 10.2.18-h12 or the hotfix listed for your 10.2 release. Unsupported releases must move to a fixed supported branch.
3. Close the management interface to the internet and allow only a few trusted internal addresses: this is the measure the vendor highlights, as no workaround exists.
4. Look for traces: search your logs for connections from 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234, review administrator logins and configuration changes, and rotate administrator passwords.
5. Threat Prevention subscribers can enable threat IDs 510046 and 510047, which the vendor says offer only partial coverage.

Our take

An admin page that is reachable from anywhere turns any leaked password into root access on the device that protects the whole network. Management interfaces belong on a dedicated network or behind a VPN, with multi-factor authentication and alerts on every new administrator session.

Sources

• Palo Alto Networks — CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
• CERT-FR — Multiples vulnérabilités dans les produits Palo Alto Networks (CERTFR-2026-AVI-1326)
• CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-0322
• The Hacker News — Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

How we choose, verify and write our analyses →