PAN-OS management interface authenticated remote code execution exploited (CVE-2026-0322)

What happened

An attacker with valid credentials for the PAN-OS management interface can execute arbitrary code with root privileges on the firewall. The CVSS 4.0 vector records a network attack, low complexity, no user interaction, and high privileges required; a successful exploit gives high confidentiality, integrity and availability impact on the vulnerable system.

Palo Alto Networks has observed very limited exploitation targeting the management interface. CISA KEV lists the issue as actively exploited, as does ENISA EUVD, which records exploitation since 14 October 2026. CISA's required action due date is 17 October 2026. Restricting management access to trusted internal IP addresses reduces the risk.

Who is affected

This affects PAN-OS software on PA-Series and VM-Series firewalls, and on Panorama virtual and M-Series appliances. Affected release lines are PAN-OS 12.2.0 to before 12.2.4, 12.1.0 to before 12.1.10-h2, 11.2.0 to before 11.2.16, 11.1.0 to before 11.1.16-h3, and 10.2.0 to before 10.2.18-h12. Cloud NGFW and Prisma Access are not impacted.

What to do now

1. Upgrade to a fixed release. The fixed builds are PAN-OS 12.2.4; 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 and 11.2.16; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3; 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 and 10.2.18-h12.
2. Restrict access to the management interface to trusted internal IP addresses before and after patching, following Palo Alto Networks' deployment guidelines.
3. Where an immediate upgrade is not possible, use the limited Threat Prevention coverage: enable Threat IDs 510046 and 510047 from Applications and Threats content 9159-10287 or later, route management traffic through a DP port, replace the Certificate for Inbound Traffic Management, and decrypt inbound management traffic. Palo Alto Networks does not list a full workaround.
4. Meet CISA's due date for mitigations: 17 October 2026.

How to detect it

Palo Alto Networks' advisory does not list detailed indicators of compromise. Review management interface authentication and configuration activity for unexpected sessions or changes, and enable Threat IDs 510046 and 510047 if management traffic is routed through a dataplane port.

Beyond the patch

Beyond patching, this is an actively exploited flaw on a management plane: the same channel administrators rely on is the target. After upgrading, confirm no management interfaces are reachable from untrusted networks and that management access is logged. Our Managed Detection & Response (MDR) can monitor for the post-exploitation activity that follows a management-plane compromise, and an Incident Response Retainer gives a tested route for containment and forensics if access has already been used.