Full Report
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]
Analysis Summary
# Vulnerability: Palo Alto Networks PAN-OS Management Interface RCE
## CVE Details
- **CVE ID:** CVE-2026-0322
- **CVSS Score:** 8.6 (High)
- **CWE:** Not specified (Remote Code Execution)
## Affected Systems
- **Products:**
- PA-Series Firewalls
- VM-Series Firewalls
- Panorama Virtual Appliances
- M-Series Appliances
- **Versions:** PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2.
- **Configurations:** Systems where the PAN-OS management interface is accessible over the network.
*Note: Cloud NGFW and Prisma Access are **not** affected.*
## Vulnerability Description
This is a Remote Code Execution (RCE) vulnerability residing in the PAN-OS management interface. The flaw allows an authenticated attacker with network access to the management interface to execute arbitrary code with **root privileges** on the underlying operating system.
## Exploitation
- **Status:** Exploited in the wild (Zero-day). Added to CISA KEV catalog.
- **Complexity:** Low (Requires valid credentials).
- **Attack Vector:** Network (Targeting the Management Interface).
## Impact
- **Confidentiality:** High (Root-level access to the device).
- **Integrity:** High (Ability to modify system configuration and code).
- **Availability:** High (Potential for full system takeover or disruption).
## Remediation
### Patches
Palo Alto Networks has released updates for the following versions:
- **PAN-OS 10.2**
- **PAN-OS 11.1**
- **PAN-OS 11.2** (Fix for 11.2.16 expected Oct 15)
- **PAN-OS 12.1**
- **PAN-OS 12.2**
*Users on unsupported versions must upgrade to a supported, patched release.*
### Workarounds
- **Strict Access Control:** Restrict access to the management interface to trusted internal IP addresses only. Do not expose the management interface to the internet.
- **Threat Prevention:** Customers with Threat Prevention subscriptions can enable specific Threat ID signatures, though the vendor warns this provides only "limited coverage" against known patterns.
## Detection
### Indicators of Compromise (IoCs)
The following IP addresses have been identified as sources of exploitation:
- 66.42.72[.]14
- 208.83.239[.]114
- 149.248.47[.]234
### Detection methods and tools
- Monitor management interface logs for unusual authenticated activity or unauthorized root-level changes.
- Utilize Palo Alto Networks Threat Prevention signatures to identify known attack patterns (noting that variations may bypass current detection).
## References
- Vendor Advisory: hxxps://security.paloaltonetworks.com/CVE-2026-0322
- CISA KEV Catalog: hxxp://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Source Article: hxxps://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/