PAN-OS: Authenticated RCE in Management Interface Allows Root Code Execution (CVE-2026-0322)
Severity: high · Patch status: patched · Since 2026-10-14 · CVE-2026-0322
Palo Alto Networks PAN-OS contains an authenticated remote code execution vulnerability (CVE-2026-0322, CWE-94 code injection) in the management interface, allowing an attacker with network access and high privileges to execute arbitrary code with root privileges on the firewall. It affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are not impacted. CISA added it to the KEV catalog on Oct 14, 2026, and the vendor reports very limited exploitation targeting management interfaces, with three associated source IPs. No workarounds exist; fixed versions have been released across all supported branches. Risk is minimized by restricting management interface access to trusted internal IPs or a jump box; Threat Prevention IDs 510046/510047 (content 9159-10287+) provide limited coverage requiring SSL decryption. US federal agencies must remediate by Oct 17, 2026 (BOD 22-01).
What to do
- Immediately upgrade PAN-OS to a fixed version per the vendor advisory (e.g., 12.2.4+, 12.1.10-h2/12.1.7-h8/12.1.4-h12, 11.2.16/11.2.13-h3/11.2.10-h15/11.2.7-h21/11.2.4-h22, 11.1.16-h3/11.1.13-h15/11.1.10-h35/11.1.7-h11/11.1.6-h39/11.1.4-h37, 10.2.18-h12/10.2.16-h11/10.2.13-h26/10.2.10-h41/10.2.7-h38); upgrade unsupported versions to a supported fixed release
- Restrict management interface access to trusted internal IP addresses or a jump box only; never expose the MGT interface to the internet
- Check logs for exploit attempts from IoC IPs 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, 149[.]248[.]47[.]234 and hunt for signs of compromise
- If immediate patching is not possible, enable Threat Prevention IDs 510046 and 510047 (content 9159-10287+), which requires routing MGT traffic through a DP port, replacing the inbound management certificate, and enabling SSL decryption of inbound management traffic
- Apply mitigations per vendor instructions in compliance with CISA BOD 26-04 and CISA Forensics Triage Requirements; evaluate each asset's internet exposure; US federal agencies must remediate by Oct 17, 2026 (BOD 22-01) — treat as outer limit
Fixed versions
- 12.2.4+
- 12.1.4-h12
- 12.1.7-h8
- 12.1.10-h2
- 11.2.4-h22
- 11.2.7-h21
- 11.2.10-h15
- 11.2.13-h3
- 11.2.16
- 11.1.4-h37
- 11.1.6-h39
- 11.1.7-h11
Sources
All live incidents on Threat Watch
