Palo Alto Networks has patched CVE-2026-0322, a code injection flaw in the PAN-OS management interface that lets an authenticated attacker with network access run code as root on PA-Series and VM-Series firewalls and on Panorama. The vendor has seen limited exploitation, and CISA has given federal agencies until October 17 to fix it.
What happened
Palo Alto Networks published its advisory on October 14, 2026 and updated it on October 15. The bug is classed as CWE-94 (code injection). The vendor rates it HIGH, CVSS 4.0 score 8.6, with urgency set to "highest" and exploit maturity marked "attacked." The company found the flaw internally, and the advisory says no special configuration is needed to exploit it. Any device whose management interface the attacker can reach is potentially at risk.
Very limited exploitation has been observed targeting the Palo Alto Networks management interface. (Palo Alto Networks advisory)
Affected products are PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected. Fixed releases listed in the advisory:
| Branch | Fixed releases |
|---|---|
| PAN-OS 12.2 | 12.2.4 and later |
| PAN-OS 12.1 | 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 |
| PAN-OS 11.2 | 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16 |
| PAN-OS 11.1 | 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3 |
| PAN-OS 10.2 | 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12 |
The right target depends on the maintenance release you run within each branch, so check the advisory's full version table before scheduling. The advisory says there are no workarounds. Threat Prevention signatures (Threat IDs 510046 and 510047) give partial coverage, but only with SSL decryption in place and management traffic passing through data plane ports. Palo Alto published three IP addresses tied to the exploitation attempts: 66.42.72.14, 208.83.239.114 and 149.248.47.234.
CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on October 14. SecurityWeek reports a federal remediation deadline of October 17 and says Palo Alto released about a dozen other advisories for medium- and low-severity issues at the same time.
Why it matters
This flaw requires authentication, which narrows who can use it. It doesn't make it safe. Anyone holding a valid admin session or credential can go from management login to root on the device, which includes the configuration, stored secrets and whatever directory or SSO integrations the firewall uses. Panorama is affected too, and Panorama pushes configuration to every firewall it manages. A root foothold there is a privileged path across the whole estate.
Palo Alto's main mitigation is to limit management access to trusted internal IPs or a jump box. If an exposed interface is combined with phished or reused admin credentials, this vulnerability gives an attacker root. Treat firewall admin accounts as privileged identities. That means named accounts, MFA where the platform supports it, and access only through a controlled admin path.
What to check in your environment
- Inventory every PA-Series, VM-Series and Panorama instance (virtual and M-Series), record the PAN-OS version, and map each one to the fixed release for its branch and maintenance line. Federal agencies have until October 17.
- Confirm that no management interface, including management profiles on data plane interfaces, is reachable from the internet or untrusted segments. Restrict access to a jump box or an internal admin network, as Palo Alto recommends.
- Search firewall, proxy and SIEM logs for connections to or from 66.42.72.14, 208.83.239.114 and 149.248.47.234.
- Review the local and directory-backed administrator accounts on each firewall and on Panorama. Remove stale or shared accounts, and check recent admin login history for unfamiliar source IPs or odd hours.
- If you can't patch right away and you meet the decryption prerequisites, check whether Threat IDs 510046 and 510047 are active in your Threat Prevention profile. Don't treat them as a replacement for upgrading.
- If you see signs of compromise, treat secrets stored on the device as exposed and rotate them with your IAM team. That includes admin passwords, LDAP/RADIUS bind accounts, API keys and certificates.