PAN-OS Vulnerability CVE-2026-0322: What It Is and How to Patch It

CVE-2026-0322, an authenticated remote code execution flaw in the management interface of Palo Alto Networks' PAN-OS, is being actively exploited and now carries a federal patch deadline. The Cybersecurity and Infrastructure Security Agency (CISA) added the bug to its Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026, giving federal civilian agencies until October 17, 2026 to remediate it. Palo Alto Networks rates the flaw 8.6 on the CVSS 4.0 scale and has published fixed PAN-OS versions across five branches. Here is what the vulnerability actually does, which versions are affected, and what to do if you cannot patch immediately.

What happened

On October 14, 2026, Palo Alto Networks published a security advisory for CVE-2026-0322, describing a remote code execution vulnerability in the PAN-OS management interface. The same day, CISA added the flaw to its Known Exploited Vulnerabilities catalog, confirming that it has observed real-world exploitation rather than just theoretical risk.

That KEV listing is what turns a routine vendor patch into urgent, deadline-driven news: it means attackers are already using this bug, not merely that researchers found it. CISA's KEV catalog data feed lists the entry with a due date of October 17, 2026 and a "forensic triage" requirement, CISA's tightest remediation category. Palo Alto's own advisory describes the observed activity as "very limited exploitation," but limited does not mean theoretical — it means the company has confirmed attempts against real deployments and published indicators of compromise for defenders to check against their own logs.

What CVE-2026-0322 actually is

According to Palo Alto Networks' advisory, titled "PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface," the flaw lets an authenticated attacker with network access to the management interface execute arbitrary code with root privileges on the firewall. It is classified as CWE-94, Improper Control of Generation of Code ("Code Injection"), matching CISA's catalog name for the bug: "Palo Alto Networks PAN-OS Code Injection Vulnerability."

The key word is "authenticated" — exploitation requires the attacker to already hold valid credentials on the device, which is why the CVSS vector sets Privileges Required to High. That requirement doesn't make the bug low-stakes, though. Once an attacker clears that bar, the practical outcome is root-level code execution on a network security appliance that typically sits at the edge of a corporate network, making it a high-value target for anyone who has already obtained or guessed administrative credentials, or who is pivoting from another compromised system.

Palo Alto's advisory lists the issue as applicable to PAN-OS software running on PA-Series and VM-Series firewalls and on Panorama (both virtual and M-Series appliances). Cloud NGFW and Prisma Access, the company's cloud-delivered firewall offerings, are explicitly not affected.

CVSS score and severity breakdown

Palo Alto Networks scores CVE-2026-0322 at 8.6 (HIGH) using CVSS 4.0, with the full vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red. The company separately lists a marginally lower score of 8.5 for deployments where management access is already restricted to a dedicated jump box, reflecting the reduced attack surface of that configuration. In both cases, the attack vector is network-based, attack complexity is low, and no user interaction is required — once an attacker has the necessary credentials, exploitation is straightforward.

Palo Alto assigns the issue a suggested urgency of "HIGHEST," its top rating, and says risk is greatest for any deployment that exposes the management interface to external, internet-facing IP addresses rather than restricting it to trusted internal networks — a long-standing best practice the company reiterates in this advisory.

Palo Alto's advisory notes that the PAN-OS 11.2.16 fix carried an estimated availability date of October 15, 2026 — one day after the advisory itself was published — so administrators on that branch should confirm the hotfix has actually shipped before assuming they are covered. Older, unsupported PAN-OS versions are not listed with fixes at all; the company's guidance there is simply to upgrade to a currently supported, patched release.

What it means that CISA added this to the KEV catalog

CISA's Known Exploited Vulnerabilities catalog is reserved for vulnerabilities the agency has confirmed are being exploited in the wild — it is not a general vulnerability database like NVD, and inclusion is a direct signal that attackers are actively using the flaw. For CVE-2026-0322, CISA's catalog entry lists the required action as applying vendor mitigations "in accordance with vendor instructions," while tying compliance to its Binding Operational Directive 26-04, which sets risk-tiered remediation timelines for U.S. federal civilian executive branch agencies.

BOD 26-04 ties each vulnerability's deadline to a risk tier based on internet exposure, KEV status, exploit automation potential, and technical impact. CISA's catalog entry for CVE-2026-0322 flags it as requiring "forensic triage," the directive's tightest tier, which calls for remediation or mitigation within three days plus a check for signs of prior compromise — explaining why the due date lands just three days after the catalog addition, on October 17, 2026.

That deadline is legally binding only for federal civilian agencies; it does not carry a legal penalty for private companies. In practice, though, security teams across industries treat KEV additions and their deadlines as the de facto patching priority list, because they reflect confirmed exploitation rather than theoretical risk scoring.

Exploitation status and indicators of compromise

Palo Alto Networks' advisory describes the observed activity as "very limited exploitation... targeting the Palo Alto Networks management interface." The company has not attributed the activity to a specific threat actor or named any confirmed victims in its public advisory, and Pandromeda has not independently verified further details beyond what the vendor and CISA have published.

The advisory does list three IP addresses associated with exploit attempts: 66.42.72.14, 208.83.239.114, and 149.248.47.234. Security teams that manage PAN-OS management interfaces should check firewall and web server logs for connections from these addresses, treating a match as a potential indicator of attempted exploitation rather than confirmed compromise, since indicators like these can be reused by multiple actors or reassigned over time.

Mitigations if you can't patch immediately

Palo Alto Networks states plainly that "no known workarounds exist for this issue" — there is no configuration change that fully closes the hole short of upgrading. The company does offer a partial, interim option for customers with a Threat Prevention subscription:

• Enable Threat IDs 510046 and 510047 (available from Applications and Threats content version 9159-10287 or later) for limited coverage against known attack patterns.
• Those Threat IDs only protect traffic that the firewall can actually inspect, which requires routing management-interface traffic through a dataplane (DP) port rather than the dedicated MGT port, replacing the certificate used for inbound traffic management, and enabling SSL decryption on that inbound traffic.
• Because the signatures provide only "limited coverage," Palo Alto warns that variant attack patterns may not be detected — this buys time, it does not replace patching.

Independent of this specific CVE, Palo Alto's longstanding best-practice guidance — reiterated in this advisory — is to never expose the PAN-OS management interface directly to the internet, and to restrict access to trusted internal IP addresses or a dedicated jump box. The advisory notes that restricting access to a jump box lowers the CVSS score only marginally (from 8.6 to 8.5), because the flaw still requires only valid credentials and network reachability, not a specific source IP, to exploit. Network segmentation reduces exposure; it is not a substitute for the patch. Palo Alto's own administrative access best-practices documentation covers how to isolate the management network, restrict source IPs, and require a jump server or multi-factor authentication for admin access.

Who needs to act

Any organization running PAN-OS on PA-Series or VM-Series hardware, or Panorama (virtual or M-Series), on a version listed in the table above is affected. That spans every actively supported PAN-OS release line — 10.2 through 12.2 — meaning the exposure is not limited to older, end-of-life deployments. Teams should prioritize checking:

• Whether the management interface is reachable from the public internet (highest urgency, per Palo Alto's own guidance).
• Whether administrative credentials for affected devices have been reused elsewhere, reset recently, or may have been exposed in a prior breach, since exploitation requires authentication.
• Whether the specific maintenance release installed is on or above the fixed version for that branch, using the table above.

How this fits the current patch cycle

CVE-2026-0322 lands in the same week as several other high-profile remediation deadlines security teams are juggling. CISA added a critical Ivanti Connect Secure flaw, CVE-2026-104935, to the KEV catalog earlier in the week, and Microsoft's October 2026 Patch Tuesday delivered one of its largest update batches in recent memory. For network and security operations teams, this means CVE-2026-0322 is one of several edge-infrastructure vulnerabilities demanding attention in the same stretch, and it should be triaged alongside — not instead of — those other deadlines based on actual exposure in each environment.

What to do next

If your organization runs PAN-OS on any supported branch, treat this as an immediate action item:

• Check your version. Compare your installed PAN-OS build against the fixed-versions table above for your branch.
• Patch now. Upgrade to the listed fixed version or later. If you're on PAN-OS 11.2 and waiting on the 11.2.16 hotfix, confirm it has shipped before standing down.
• Lock down the management interface. If you cannot patch immediately, verify the management interface is not reachable from the internet and is restricted to trusted internal addresses or a jump box.
• Check logs against the published IPs. Search firewall and management-interface logs for connections from 66.42.72.14, 208.83.239.114, or 149.248.47.234.
• Enable Threat Prevention signatures if you have the subscription. Turn on Threat IDs 510046 and 510047 as a stopgap, with the dataplane-routing and SSL-decryption prerequisites in place — understanding this is limited coverage, not a fix.
• Review administrative credentials. Since exploitation requires authentication, rotate and audit credentials for management access to affected devices.
• Track federal guidance. Federal civilian agencies should follow the October 17, 2026 deadline under BOD 26-04; everyone else should treat it as a strong signal of priority, not a compliance requirement.

Palo Alto Networks says it will continue to update its advisory as more fixed versions ship and as its understanding of the exploitation activity evolves; checking the official advisory page directly, rather than relying on secondary summaries, is the most reliable way to confirm your specific deployment's status.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage