PAN-OS CVE-2026-0322: exploited root RCE in the management interface

CVE-2026-0322 is not a pre-authentication bug, and that is the point to hold on to. The attacker needs valid credentials with high privileges and a network path to the PAN-OS management interface. With both, they can run code as root on the firewall or on Panorama. It turns a stolen or reused admin login into full control of the device that enforces your network policy.

Palo Alto Networks published the advisory on 14 October 2026, saying it had already seen very limited exploitation against the management interface. CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day and gave federal agencies until 17 October to act. Palo Alto updated the advisory on 15 October, when the 11.2.16 fix shipped.

Who is affected

PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected. Each branch has several fixed hotfix builds; stay on your hotfix line or move to the newest fix:

No special configuration is needed to be vulnerable. What decides your risk is who can reach the management interface. It is highest when the interface is reachable from the internet, and lower when only a jump box can reach it: Palo Alto scores the first case 8.6 and the second 8.5 under CVSS 4.0. Remember that interface management profiles can publish management services on data-plane interfaces, not only on the dedicated MGT port.

How CVE-2026-0322 works

Palo Alto classifies the bug as code injection (CWE-94) in the management interface. An authenticated attacker can get input interpreted as code, and that code runs with root privileges on the device. The vendor's CVSS vector rates the privileges required as high, which in CVSS terms means significant, typically administrative, control.

Palo Alto has not published technical detail beyond that, and we did not find an independent root-cause analysis. The bug was found internally, credited to Suraj Siddharudh of Palo Alto Networks.

The scores differ by source. Palo Alto rates it 8.6 under CVSS 4.0. NVD rates it 7.2 under CVSS 3.1. Some secondary write-ups give 9.5, but no vendor, CNA or NVD record carries that figure.

Is it being exploited?

Yes, on the vendor's own word. Palo Alto says it has seen very limited exploitation targeting the management interface, and published three IP addresses tied to the activity and to limited exploit attempts.

CISA listed the CVE in KEV on 14 October 2026 with a due date of 17 October and marked forensic triage as required under BOD 26-04. Ransomware use is listed as unknown. No threat actor, start date or victim count has been published; BleepingComputer asked Palo Alto those questions and reported no answers.

Check your exposure

Confirm the running version and who is allowed to reach management:

# Operational mode: software and threat content versions.
show system info | match sw-version
show system info | match app-version
 
# Configure mode: allowed source IPs for the MGT interface,
# and management profiles that expose services on data-plane interfaces.
configure
show deviceconfig system permitted-ip
show network profiles interface-management-profile
exit

An empty permitted-IP list means any address that can route to the MGT port may connect. From a network you do not trust, also test whether the management web interface answers at all.

Fix it

Upgrade to the fixed build for your branch. Palo Alto says no known workaround exists. Panorama and every managed firewall need their own upgrade.

Until you can upgrade, narrow the attack surface:

• Restrict access. Allow management only from trusted internal IPs or a jump box.
• Inspect management traffic. Threat Prevention customers can enable Threat IDs 510046 and 510047 (Applications and Threats content 9159-10287 or later). Palo Alto calls this limited coverage, and it only works if inbound management traffic passes through a data-plane interface with SSL decryption and threat prevention.
• Review admin accounts. The bug needs credentials, so remove unused administrators and rotate any that may have been exposed.

Detect attempts and compromise

Palo Alto published two signals; the third is standard practice:

• Threat IDs. Alerts for 510046 or 510047 on traffic to management services.
• IP addresses. Connections to the management interface from 66.42.72.14, 208.83.239.114 or 149.248.47.234 in traffic, system or authentication logs.
• Admin activity. Logins or configuration changes from unexpected sources or at unexpected times.

The vendor has published no host-level indicators. If any of these fired before you patched, treat the device as compromised: the attacker ran as root. Follow CISA's forensic triage requirements before rebuilding, and rotate every credential and key the device held.

Beyond this patch

A management plane is only as strong as the credentials and networks that reach it. Keep firewall management off the internet, behind a jump box, with few administrators, and confirm a fix with evidence rather than a version string. How a retest verifies a fix explains what that evidence looks like.