Palo Alto Networks PAN-OS CVE-2026-0322 (CVSS 4.0 8.6, urgency HIGHEST): authenticated root RCE in the management interface of PA-Series, VM-Series and Panorama — very limited exploitation observed, three attacker IPs published

Palo Alto Networks published CVE-2026-0322 on 14 October 2026 (16:00 UTC; 15 Oct 00:00 Perth). A code-injection flaw (CWE-94) in the PAN-OS management interface lets an authenticated attacker with network access run arbitrary code as root on the firewall. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not affected, and no special configuration is needed to be exposed. Palo Alto rates it HIGH with suggested urgency HIGHEST, Exploit Maturity ATTACKED, and says very limited exploitation has been observed targeting the management interface. The advisory lists three IP addresses tied to the activity and limited exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234. There is no workaround; Threat Prevention Threat IDs 510046 and 510047 (content 9159-10287 and later) give only limited coverage and need management traffic routed through a data-plane interface with SSL decryption. Risk is highest where the management interface is reachable from the internet. The same 14 Oct bulletin also carries lower-rated PAN-OS, GlobalProtect app, Cortex XSOAR and Checkov fixes, listed separately on the Palo Alto advisory site. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on 14 October 2026 with a 17 October due date for US federal agencies (BOD 26-04). Wires on 15 Oct: SecurityWeek and The Hacker News.

Product

Palo Alto Networks PAN-OS (PA-Series, VM-Series, Panorama virtual and M-Series)

Versions

Affected: PAN-OS 12.2 < 12.2.4; 12.1 < 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2; 11.2 < 11.2.4-h22 / 11.2.7-h21 / 11.2.10-h15 / 11.2.13-h3 / 11.2.16; 11.1 < 11.1.4-h37 / 11.1.6-h39 / 11.1.7-h11 / 11.1.10-h35 / 11.1.13-h15 / 11.1.16-h3; 10.2 < 10.2.7-h38 / 10.2.10-h41 / 10.2.13-h26 / 10.2.16-h11 / 10.2.18-h12; older unsupported PAN-OS also affected. Not affected: Cloud NGFW, Prisma Access.

CVSS

8.6 (CVSS 4.0, internet-facing management); 8.5 when management is restricted to an adjacent jump box

Exploited in Australia?

unknown

Patch to

Upgrade to the fixed build for your train: 12.2.4; 12.1.10-h2 (or 12.1.7-h8 / 12.1.4-h12); 11.2.16 (vendor ETA 15 Oct) or 11.2.13-h3 / 11.2.10-h15 / 11.2.7-h21 / 11.2.4-h22; 11.1.16-h3 (or the matching 11.1 hotfix); 10.2.18-h12 (or the matching 10.2 hotfix). Until patched, allow management access only from trusted internal IPs or a jump box, check logs for the three published IPs, and treat any internet-exposed management interface as potentially compromised.

Primary: Palo Alto Networks — CVE-2026-0322 PAN-OS: Authenticated RCE in the Management Interface (14 Oct 2026) · Vendor: Palo Alto Networks PSIRT advisory (fixed versions, Threat IDs, IoCs) · CVE: CVE-2026-0322 · SecurityWeek — Palo Alto Networks patches PAN-OS zero-day exploited for RCE (15 Oct 2026); also The Hacker News

vulnerabilities network