Article
CISA KEV additions, 13 to 16 Oct 2026: patch order
CISA added nine exploited flaws to its KEV catalog from 13 to 16 October 2026. See each product, the fix, the due date and…
Read more
Exploited vulnerability
PAN-OS CVE-2026-0322: management RCE and fixes
A flaw in the management interface of Palo Alto Networks PAN-OS, the software that runs its firewalls and Panorama management servers.
- On CISA KEV
- CVE ID
- CVE-2026-0322
- CVSS
- 7.2 High (CVSS v3.1, NVD); 8.6 High (CVSS v4.0, vendor record in NVD); 8.5 if management access is limited to a jump box (vendor)
- CISA KEV
- Listed
- Affected product
- PAN-OS (PA-Series, VM-Series and Panorama)
- Exploited
- 14 October 2026 (CISA KEV listing)
- Published
- October 2026
In short
CVE-2026-0322 is a flaw in the management interface of Palo Alto Networks PAN-OS, the software that runs its firewalls and Panorama management servers. An attacker who can log in and reach the interface over the network can run code with root rights on the firewall. The vendor reports very limited attacks, and CISA lists it as exploited.
- CVECVE-2026-0322
- ProductPalo Alto Networks PAN-OS (PA-Series, VM-Series and Panorama)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUpgrade to a fixed release · Check for signs of attack
What it allows
An attacker with valid credentials and network access to the management interface can run any code as root on the firewall. Root control of a firewall could let an attacker change rules, read stored secrets and move deeper into the network. This is different from our pages on CVE-2024-3400 and CVE-2026-0257, which are flaws in the GlobalProtect VPN feature. Here the weak point is the management interface, so keeping it off untrusted networks is the first defence. The vendor rates the exploit maturity as attacked and describes very limited exploitation aimed at the management interface.
Who is affected
The flaw applies to PAN-OS on PA-Series and VM-Series firewalls and on Panorama, both virtual and M-Series. Cloud NGFW and Prisma Access are not affected, per the vendor. Per the vendor advisory, fixed releases are: 12.2.4; 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 and 11.2.16; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3; 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 and 10.2.18-h12. Older versions that are no longer supported must upgrade to a supported fixed version.
The vendor published the advisory on 14 October 2026 and added release 11.2.16 on 15 October 2026. CISA added the flaw to the Known Exploited Vulnerabilities (KEV) catalog on 14 October 2026, with a due date of 17 October 2026, and marks the forensic triage field as Yes. The KEV entry shows ransomware campaign use as Unknown. No government source we opened names an actor or malware behind the attacks, so this page names none.
Timeline
-
14 Oct 2026
The vendor published its advisory and the NVD record was created. CISA added the flaw to the KEV catalog.
-
15 Oct 2026
The vendor added PAN-OS 11.2.16 as a fixed release, and the NVD record was updated.
-
17 Oct 2026
CISA KEV due date for federal agencies to apply the vendor mitigations.
What to do
-
Upgrade to a fixed release
Move each firewall and Panorama to the fixed release for its branch, listed in the vendor advisory. The vendor says no workaround exists, so upgrading is the real fix.
-
Take the management interface off untrusted networks
Allow management access only from trusted internal addresses, as the vendor's best practice guide says. The vendor also suggests a single jump box as the only system that may reach the interface.
-
Use the vendor's extra controls while you patch
Route management port traffic through a data plane port, replace the certificate used for inbound management traffic and decrypt that traffic. With a Threat Prevention subscription, enable Threat IDs 510046 and 510047 (content version 9159-10287 or later). The vendor says this gives limited coverage and needs SSL Decryption.
-
Check for signs of attack
Review management logins and admin changes since 14 October 2026. The vendor lists three IP addresses tied to attack attempts: 66.42.72.14, 208.83.239.114 and 149.248.47.234. Look for them in management interface logs.
-
If you suspect a compromise
CISA marks this entry for forensic triage, so keep logs and a device snapshot before you rebuild. Rotate admin credentials and any secrets stored on the device.
Questions
What is CVE-2026-0322?
It is a code injection flaw (CWE-94) in the PAN-OS management interface. An authenticated attacker with network access can run code as root on the firewall.
Is this the same as the GlobalProtect flaws?
No. The GlobalProtect command injection CVE-2024-3400 is in the VPN feature. The GlobalProtect authentication bypass CVE-2026-0257 is in the same feature. CVE-2026-0322 is in the management interface.
Does the attacker need a login?
Yes. The vendor lists privileges required as high, so the attacker needs valid access first. That is why limiting who can reach the interface and protecting admin accounts matter.
Is CVE-2026-0322 exploited?
Yes. CISA added it to the KEV catalog on 14 October 2026. The vendor reports very limited exploitation of the management interface. It is one of nine flaws listed in our CISA KEV roundup for 13 to 16 October 2026.
Are Prisma Access and Cloud NGFW affected?
No. The vendor says both are not affected and need no action.
In our research
- CISA KEV additions, 13 to 16 Oct 2026: patch order October 2026
Sources
- CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface Palo Alto Networks Security Advisories
- CVE-2026-0322 record NIST NVD
- Known Exploited Vulnerabilities catalog (JSON feed, entry CVE-2026-0322) CISA
- BOD 26-04 Prioritizing Security Updates Based on Risk CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 25 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 54 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 37 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 50 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 105 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.