CISA has added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog: a code injection flaw in the PAN-OS management interface that lets an authenticated attacker with network access run arbitrary code as root on affected firewalls.
What Is It
CVE-2026-0322 is a remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS. It is classified as code injection (CWE-94). An attacker who is authenticated and has network access to the management interface can use it to run arbitrary code with root privileges on the firewall.
Palo Alto Networks published the issue, and NVD received the record on 2026-10-14. NVD has not yet listed a CVSS score, severity or vector.
Why It Matters
CISA added CVE-2026-0322 to the KEV catalog on 2026-10-14, which confirms it is being exploited in the wild. The remediation due date is 2026-10-17, only three days after it was added. The KEV entry also marks the flaw for forensic triage ("forensicTriage": "Yes"). That means organizations should check for compromise as well as patch. Whether ransomware campaigns have used it is listed as "Unknown."
Code execution as root on a firewall gives an attacker full control of a device that sits at the network perimeter.
What's Vulnerable
According to the vendor description, the issue affects:
- PAN-OS software on PA-Series and VM-Series firewalls
- Panorama (virtual and M-Series)
The NVD affected-version data lists many builds and hotfix levels across the PAN-OS 12.2, 12.1, 11.2 and 11.1 branches. Check the vendor advisory for the full and authoritative list of affected versions.
Not affected: Cloud NGFW (all versions) and Prisma Access.
Patch Status
CISA's required action is to apply mitigations according to vendor instructions, following BOD 26-04 ("Prioritizing Security Updates Based on Risk") and CISA's Forensics Triage Requirements. If mitigations are unavailable, follow the BOD 26-04 guidance for cloud services or stop using the product. Stakeholders must assess each asset's internet exposure and follow BOD 26-04 patching guidelines.
Palo Alto Networks says the risk is greatly reduced by limiting management interface access to trusted internal IP addresses only, as described in its best-practice deployment guidelines. The supplied data does not list fixed versions; see the vendor advisory for them.