[Urgent] Palo Alto Networks PAN-OS CVE-2026-0322: Authenticated RCE as Root in the Management Interface (CVSS v4.0 8.6) — Exploited; Update and Keep the Management Interface Off the Internet

PAN-OS, the firewall operating system from Palo Alto Networks, has a flaw in its management interface that lets an authenticated attacker run arbitrary code with root privileges on the appliance. It is CVE-2026-0322. The vendor published its advisory on 14 October 2026 and wrote that "very limited exploitation has been observed targeting the Palo Alto Networks management interface." CISA added it the same day to KEV (its catalog of known exploited vulnerabilities), with a US federal due date of 17 October.

There is no workaround. Update to a fixed version. And check today whether your management interface is reachable from the internet. The vendor says the risk is highest when management access is allowed from external IP addresses on the internet. No special configuration is needed to be affected (the advisory's configuration section).

In yesterday's (15 October) article I gave only a short summary of the PAN-OS entry among the four KEV additions. Today I opened the vendor advisory and checked the fixed-version list, so this is the full write-up.

Where this score comes from. 8.6 is the CVSS v4.0 rating assigned by the CNA, Palo Alto Networks, with vector `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` (the case where the management interface is reachable from the internet). For the case where management access is limited to a single jump box the vendor gives a separate value: 8.5 on v4.0 (attack vector adjacent).

When checked on 15 October 2026, NVD showed the record as Analyzed, with NIST assigning CVSS v3.1 7.2 (HIGH) (vector `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`). The numbers differ because the versions differ. This article uses the vendor's v4.0 value in the box and lists NIST's alongside it. The weakness is CWE-94 (improper control of generation of code).

What to do now

• ✓Check whether you are affected. It applies to PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected (vendor)
• ✓Check where management access can come from, and limit it to trusted internal IP addresses. That is the vendor's recommended best practice. If the management interface is reachable from the internet, close that first (you can do this without waiting for the update)
• ✓Going further, limit management access to a single jump box. The vendor says this reduces the risk of exploitation
• ✓Update to a fixed version. Pick the row in the fixed-version list below that matches your version. Plan the update within the vendor's procedure and your maintenance window
• ✓Stopgap until you update: with a Threat Prevention subscription, Threat IDs 510046 and 510047 (Applications and Threats content 9159-10287 or later) give limited coverage. They only work under conditions (see "Workarounds and stopgaps"), and SSL decryption is required
• ✓Look for signs of abuse. Check logs for unexpected logins to the management interface and for unexpected configuration or account changes. The vendor FAQ lists three IP addresses associated with this activity: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234 (written with "[.]" as the vendor does, so nobody opens them by accident). Also check the management-interface logs for connections from these IPs. Finding none does not prove you were not compromised (our addition)

What happens (vendor description)

• ▸Where and what: a remote code execution (RCE) flaw in the PAN-OS management interface, titled "PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface." An authenticated attacker with network access can run arbitrary code as root
• ▸What "authenticated" means: the attacker needs credentials that let them log in to the management interface (PR:H in the CVSS vector). How attackers got through authentication in the observed exploitation is not stated in the advisory
• ▸Exploitation: the vendor reports "very limited exploitation." CISA added it to KEV. Who is using it and at what scale has not been published
• ▸Not affected: Cloud NGFW and Prisma Access (stated by the vendor)

Fixed versions (from the vendor advisory)

Move to the fixed version for the row that matches your version. Versions ending in -h are hotfixes within the same train. For the 11.2 train, 11.2.16 was published on 15 October 2026 (the advisory's update history). At the initial publication on 14 October it was not yet available for some 11.2 rows.

• ▸PAN-OS 12.2: 12.2.0 through 12.2.3 → 12.2.4 or later
• ▸PAN-OS 12.1: 12.1.8 through 12.1.10-h* → 12.1.10-h2 or later / 12.1.5 through 12.1.7-h* → 12.1.7-h8 or 12.1.10-h2 or later / 12.1.2 through 12.1.4-h* → 12.1.4-h12 or 12.1.10-h2 or later
• ▸PAN-OS 11.2: 11.2.14 through 11.2.15 → 11.2.16 or later / 11.2.11 through 11.2.13-h* → 11.2.13-h3 or 11.2.16 or later / 11.2.8 through 11.2.10-h* → 11.2.10-h15 or 11.2.16 or later / 11.2.5 through 11.2.7-h* → 11.2.7-h21 or 11.2.16 or later / 11.2.0 through 11.2.4-h* → 11.2.4-h22 or 11.2.16 or later
• ▸PAN-OS 11.1: 11.1.14 through 11.1.16-h* → 11.1.16-h3 or later / 11.1.11 through 11.1.13-h* → 11.1.13-h15 or 11.1.16-h3 or later / 11.1.8 through 11.1.10-h* → 11.1.10-h35 or 11.1.16-h3 or later / 11.1.7 through 11.1.7-h* → 11.1.7-h11 or 11.1.16-h3 or later / 11.1.5 through 11.1.6-h* → 11.1.6-h39 or 11.1.16-h3 or later / 11.1.0 through 11.1.4-h* → 11.1.4-h37 or 11.1.16-h3 or later
• ▸PAN-OS 10.2: 10.2.17 through 10.2.18-h* → 10.2.18-h12 or later / 10.2.14 through 10.2.16-h* → 10.2.16-h11 or 10.2.18-h12 or later / 10.2.11 through 10.2.13-h* → 10.2.13-h26 or 10.2.18-h12 or later / 10.2.8 through 10.2.10-h* → 10.2.10-h41 or 10.2.18-h12 or later / 10.2.0 through 10.2.7-h* → 10.2.7-h38 or 10.2.18-h12 or later
• ▸Older, unsupported PAN-OS versions: upgrade to a supported fixed version (vendor)
• ▸Cloud NGFW and Prisma Access: no action needed (vendor)

Workarounds and stopgaps

• ▸The vendor says there are no known workarounds.
• ▸Limited coverage (a stopgap): customers with a Threat Prevention subscription get limited coverage by enabling Threat IDs 510046 and 510047 (Applications and Threats content 9159-10287 or later). For these to work the vendor lists the following: route incoming management-port traffic through a data-plane (DP) port, enabling a management profile on a DP interface; replace the certificate for inbound traffic management; decrypt inbound traffic to the management interface so the firewall can inspect it; enable threat prevention on inbound traffic to management services. SSL decryption is required
• ▸This is not a fix. The coverage is limited and the conditions are heavy, so updating and restricting where management access comes from is the main line (our view)

Timeline

• ▸14 October 2026: Palo Alto Networks published the advisory (initial publication). The same day CISA added it to KEV and NVD recorded CVE-2026-0322 (NVD lists a federal due date of 17 October, which binds US federal agencies, not Japanese organizations, but shows how urgent it is considered)
• ▸15 October: the vendor updated the advisory to say 11.2.16 had been published. NVD moved to "Analyzed" and NIST assigned CVSS v3.1 7.2
• ▸Reporter: the vendor credits an internal reporter. How outside attackers found it is not stated in the advisory
• ▸Also added to KEV on 14 October: Cisco Secure Email Gateway (CVE-2026-76519) and others. I covered Cisco in detail in the 15 October article

What I could not confirm

• ▸The actual attacks. Who is exploiting it, at what scale and against whom is not in the vendor material. What "very limited" means is unknown
• ▸How attackers got through management authentication. The advisory says only "authenticated" and does not say how credentials were obtained
• ▸The full set of indicators of compromise. The vendor lists the three IP addresses above. The advisory gives no log patterns or file names. Whether attackers use other IPs cannot be told from the public material
• ▸The release history of each fixed version. I confirmed that 11.2.16 was published on 15 October but not whether every other fixed version was already available on 14 October
• ▸The vendor's update procedure. This article copies the advisory's fixed-version table; it is not an upgrade manual. Follow the vendor's official procedure for the actual update

Three lines to share

• ▸Palo Alto's firewall OS (PAN-OS) has a flaw in its management interface (CVE-2026-0322, CVSS v4.0 8.6) that lets an authenticated attacker run code as root, and the vendor reports very limited exploitation. There is no workaround, and CISA added it to KEV on 14 October
• ▸★Limit the management interface to trusted internal IPs; if it is reachable from the internet, close that first. Then update to the fixed version for your train (for example 11.2.16 or later on 11.2, 12.2.4 or later on 12.2). Cloud NGFW and Prisma Access are not affected
• ▸Check management-interface logs before and after updating. The vendor lists three associated IPs (66[.]42[.]72[.]14, 208[.]83[.]239[.]114, 149[.]248[.]47[.]234). Look for connections from them, and for unexpected logins or configuration changes. Finding none is not proof you are safe