Full Report
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an
Analysis Summary
# Vulnerability: Palo Alto Networks PAN-OS Management Interface RCE
## CVE Details
- **CVE ID:** CVE-2026-0322
- **CVSS Score:** 8.6 (High)
- **CWE:** Not specified in the article (Remote Code Execution)
## Affected Systems
- **Products:** Palo Alto Networks PAN-OS software on PA-Series (Hardware), VM-Series (Virtual Firewalls), and Panorama (M-Series and Virtual).
- **Versions:**
- PAN-OS 12.2
- PAN-OS 12.1
- PAN-OS 11.2
- PAN-OS 11.1
- PAN-OS 10.2
- **Configurations:** Systems where the management interface is accessible. Note: Cloud NGFW and Prisma Access are **not** affected.
## Vulnerability Description
This is a remote code execution (RCE) vulnerability residing in the management interface of PAN-OS. The flaw allows an authenticated attacker with network access to the management interface to execute arbitrary code with root privileges on the underlying firewall or management appliance.
## Exploitation
- **Status:** Exploited in the wild (Limited exploitation observed).
- **Complexity:** Low (No special configuration required for exploitation).
- **Attack Vector:** Network (Requires access to the management interface).
## Impact
- **Confidentiality:** High (Root-level access to the device).
- **Integrity:** High (Ability to execute arbitrary code).
- **Availability:** High (Full system compromise).
## Remediation
### Patches
Palo Alto Networks has released security updates for the following versions:
- **PAN-OS 12.2.4** and later
- **PAN-OS 12.1.x:** 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 and later
- **PAN-OS 11.2.x:** 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16 and later
- **PAN-OS 11.1.x:** 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3 and later
- **PAN-OS 10.2.x:** 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12 and later
### Workarounds
- **Isolate Management Interface:** Restrict access to the management interface to trusted internal IP addresses only.
- **Jump Box:** Utilize a secure jump box as the sole system permitted to access the management interface to reduce the attack surface.
## Detection
### Indicators of Compromise (IoCs)
The following IP addresses have been linked to exploitation attempts:
- 66.42.72[.]14
- 208.83.239[.]114
- 149.248.47[.]234
### Detection Methods and Tools
- Review management interface logs for unauthorized or suspicious authenticated sessions.
- Monitor for the listed IoCs in firewall/SIEM logs.
- CISA has added this to the KEV (Known Exploited Vulnerabilities) catalog, signaling it should be prioritized for immediate scanning and remediation.
## References
- **Vendor Advisory:** hxxps://security.paloaltonetworks[.]com/CVE-2026-0322
- **CISA KEV Catalog:** hxxps://www.cisa[.]gov/known-exploited-vulnerabilities-catalog
- **Source Article:** hxxps://thehackernews[.]com/2026/10/palo-alto-networks-patches-pan-os.html