PAN-OS CVE-2026-0322: root RCE on the management interface, actively exploited

Palo Alto Networks disclosed CVE-2026-0322 on October 14: an authenticated attacker with network access to the PAN-OS management interface can execute arbitrary code as root on the firewall. CISA added it to the Known Exploited Vulnerabilities catalog the same day with a federal remediation deadline of October 17, because Palo Alto has already observed exploitation in the wild. The reflex when you read "authenticated" and PR:H is to file this below the unauthenticated bugs — and that reflex is exactly what the attackers exploiting it right now are counting on.

Developing story — first published 13:45 CEST (11:45 UTC), October 15, 2026. Updated as the vendor and CISA publish more.

At a glance

CVE	CVE-2026-0322
Product / affected versions	PAN-OS on PA-Series · VM-Series · Panorama (virtual and M-Series); 10.2 before 10.2.18-h12 · 11.1 before 11.1.16-h3 · 11.2 before 11.2.16 · 12.1 before 12.1.10-h2 · 12.2 before 12.2.4. Cloud NGFW and Prisma Access not affected
Fixed in	Minimum fixed builds: 10.2.18-h12 · 11.1.16-h3 · 11.2.16 · 12.1.10-h2 · 12.2.4 (per-maintenance hotfixes listed in Remediation); released October 14, 2026
CVSS	8.6 HIGH · CVSS 4.0 · scored by Palo Alto PSIRT · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
Exploited in the wild	Yes — "very limited exploitation" per Palo Alto; CISA SSVC exploitation state active
CISA KEV	Added 2026-10-14; federal due date 2026-10-17 (BOD 26-04, forensic triage required)
Official advisory	security.paloaltonetworks.com/CVE-2026-0322

Authenticated is not the reassurance it sounds like

The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H. PR:H means the attacker needs high-privilege authentication — a valid administrator session on the device. On its own that reads like a bug you can afford to patch next maintenance window. Two facts override that:

• It is already being exploited. Palo Alto's advisory states that "very limited exploitation has been observed targeting the Palo Alto Networks management interface," and CISA's SSVC assessment records the exploitation state as active. KEV listing is not a theoretical severity label; it is a statement that someone is using this against real firewalls now.
• Admin on a firewall is total. The weakness is CWE-94, code injection, and the impact is arbitrary code execution as root on the device that sees and shapes all your traffic. The confidentiality, integrity and availability impact are all High. A firewall running attacker code is not a compromised endpoint — it is a compromised choke point.

The question the version string cannot answer is how an attacker reaches PR:H in the first place. Stolen admin credentials, a hijacked session, a phished operator, a reused password from a prior breach, or — the one that turns this from an insider problem into an internet problem — a management interface that is reachable from untrusted networks at all. Palo Alto has repeatedly had to tell customers to get the management interface off the public internet, and the fact that it observed exploitation targeting the management interface tells you some of those interfaces were reachable.

"We're patched to 11.2.13, we're fine." Patched, yes. But is TCP/443 on the management interface answering from anywhere outside your jump-host subnet? That is a different question, and it is the one that decides whether PR:H is a real brake or a speed bump.

This is the same lesson as the GlobalProtect cookie-forge bug we wrote up in June: patch state is not configuration state. You can hold the fixed build and still be exposed by how the box is reachable.

Who is exposed and how to check your version

CVE-2026-0322 affects PAN-OS on PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama (both virtual and M-Series appliances). No special configuration is required to be vulnerable to the underlying flaw. Cloud NGFW and Prisma Access are not affected.

Check your running version from the CLI or the dashboard:

show system info | match sw-version

Compare it against the minimum fixed build for your branch (see Remediation). If you are below it, you are affected.

Remediation

1. Am I affected?

Confirm the running train and whether the management interface is reachable from anything you do not control:

show system info | match sw-version
show interface management | match "ip address"

Then, from outside the management network, confirm the plane is not answering: a curl -sk --max-time 5 https://<mgmt-ip>/ that connects from an untrusted segment is a finding in its own right, independent of the patch level.

2. Patch — exact fixed versions

Upgrade to your branch's fixed build (verbatim from the Palo Alto advisory):

Branch	Fixed builds
10.2	10.2.7-h38 · 10.2.10-h41 · 10.2.13-h26 · 10.2.16-h11 · 10.2.18-h12 (or later)
11.1	11.1.4-h37 · 11.1.6-h39 · 11.1.7-h11 · 11.1.10-h35 · 11.1.13-h15 · 11.1.16-h3 (or later)
11.2	11.2.4-h22 · 11.2.7-h21 · 11.2.10-h15 · 11.2.13-h3 · 11.2.16 (or later)
12.1	12.1.4-h12 · 12.1.7-h8 · 12.1.10-h2 (or later)
12.2	12.2.4 (or later)

Pick the fixed build at or above your current maintenance release; older unsupported trains must move to a supported fixed version. The 11.2.16 build carried a listed ETA of October 15, so confirm availability before you plan that window.

3. Can't patch now? Compensating controls

Palo Alto states there is no workaround that removes the vulnerability. What lowers your exposure:

• Restrict the management interface to trusted internal IPs only. This is the primary mitigation; restricting access to a dedicated jump host even lowers the scored severity (to 8.5, AV:A) because the attack surface is no longer the broad network.
• Threat Prevention gives partial coverage, not a fix. Threat IDs 510046 and 510047 (Applications and Threats content 9159-10287 or later) provide limited protection, require SSL decryption on management traffic, and may miss variants. Treat them as a net while you stage the patch, not as the patch.

4. Hunt for compromise

Palo Alto published three IP addresses associated with threat activity and limited exploit attempts. Search your management-plane and perimeter logs for connections to or from:

• 66.42.72.14
• 208.83.239.114
• 149.248.47.234

Map the hunt to MITRE ATT&CK: exploitation for privilege-to-code-execution against an exposed service (T1190 Exploit Public-Facing Application where the management interface is internet-reachable; T1059 Command and Scripting Interpreter for the code-injection payload; T1078 Valid Accounts for the authenticated prerequisite). Because the flaw yields root on the firewall itself, the device's own logs are evidence that an attacker with code execution could have altered — correlate against an off-box log store and network telemetry, not the firewall's local view alone.

5. Eradicate and verify

CISA's KEV entry flags forensic triage as required under BOD 26-04. If you find any indicator of execution, treat the firewall as compromised: capture state for forensics, rebuild from a known-good image rather than patching in place, rotate every credential and API key the device held or could reach (admin accounts, RADIUS/TACACS secrets, certificates, management API tokens), and only then confirm the fixed build is running. Re-test that the management interface is unreachable from untrusted networks after the rebuild — the configuration drift that exposed it the first time is the thing most likely to come back.

What is not known yet

• No named threat actor or campaign has been publicly attributed; knownRansomwareCampaignUse is Unknown in the KEV entry as of this writing.
• No public proof-of-concept has surfaced in the sources available at publication; the published IP indicators are the only technical detail released.
• NVD enrichment is incomplete — the record is Undergoing Analysis with only the Palo Alto CVSS 4.0 score present, no independent NVD score yet.
• The authentication vector in observed attacks — how exploiting operators obtained the required PR:H session — is not described in the advisory.

We will update this post as the vendor and CISA publish more.

Closing: the fix is fragmented, and the brake is a configuration

Five supported branches, roughly thirty fixed builds, a two-day federal deadline, and a compensating control that depends on whether a single interface is reachable — the hard part of CVE-2026-0322 is not understanding it, it is sequencing the response across a fleet without guessing. Zero Hunt's AI Remediation Advisor ranks findings by real exploitability — CISA KEV first, then what the campaign actually proved reachable on your boxes, then CVSS and EPSS — so the internet-facing firewall whose management interface answered an unauthenticated probe is patched before the one behind a jump host. It emits the exact fixed build per branch with rollout and rollback notes, the management-interface ACL as a compensating control while the window is scheduled, and then re-verifies the fix with the same proof that demonstrated the exposure, every record signed at write time (Ed25519, hash-chained) for the forensic-triage obligation the KEV entry imposes.

Getting there first means not trusting the version table. Because this is PR:H, the operational question is whether an attacker path to the management interface exists at all on your deployment — and that is what continuous automated penetration testing with an autonomous AI red team answers that a scanner cannot. Zero Hunt runs black-box by default against the real appliance: the 10-agent swarm fingerprints the platform and train, maps whether the management plane is reachable from where it should not be, and — with a human in the loop gating every active step — proves exploitability per target with a generative, per-environment proof-of-concept rather than assuming it from a CVSS number. On-premise, on private models, so nothing about your perimeter leaves the box.