T
Threats
Palo Alto Networks PAN-OS Management Interface Remote Code Execution Vulnerability
Overview
Vendor: Palo Alto Networks
CVSS Score: CVSS v4.0 score 8.6
Advisory date: 20 October 2026
Vendor publication: 14 October 2026; last updated 15 October 2026.
CVE: CVE-2026-0322.
Palo Alto Networks has published fixes for an authenticated remote code execution vulnerability in the PAN-OS management interface. Successful exploitation could allow an attacker to execute arbitrary code with root privileges on the firewall. The issue affects PAN-OS on PA-Series and VM-Series firewalls and Panorama, including virtual and M-Series deployments. Cloud NGFW and Prisma Access are not affected.
The vendor reports very limited exploitation targeting the management interface and recommends remediation as soon as possible. Prioritise affected systems whose management interfaces are accessible from external internet IP addresses. Restricting access reduces exposure but does not replace upgrading to an unaffected release.
Affected Versions
The following guidance applies to CVE-2026-0322 on the affected firewall and Panorama platforms.
PAN-OS 12.2
Affected: 12.2.0 through 12.2.3.
Fixed: 12.2.4 or later in the 12.2 branch.
PAN-OS 12.1
Affected: Releases before 12.1.10-h2, except the fixed maintenance releases identified below and subsequent fixed releases on those maintenance lines.
Fixed maintenance releases: 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2.
Vendor upgrade paths:
12.1.8 through affected 12.1.10 hotfix builds: upgrade to 12.1.10-h2 or later.
12.1.5 through affected 12.1.7 hotfix builds: upgrade to 12.1.7-h8 or 12.1.10-h2 or later.
12.1.2 through affected 12.1.4 hotfix builds: upgrade to 12.1.4-h12 or 12.1.10-h2 or later.
The CVE record includes affected releases from 12.1.0, while the vendor's detailed solution table begins at 12.1.2. For 12.1.0 or 12.1.1, use the vendor's supported upgrade guidance to reach a listed fixed release; do not assume those versions are unaffected.
PAN-OS 11.2
Affected: Releases before 11.2.16, except the fixed maintenance releases identified below and subsequent fixed releases on those maintenance lines.
Fixed maintenance releases: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 and 11.2.16.
Vendor upgrade paths:
11.2.14 through 11.2.15: upgrade to 11.2.16 or later.
11.2.11 through affected 11.2.13 hotfix builds: upgrade to 11.2.13-h3 or 11.2.16 or later.
11.2.8 through affected 11.2.10 hotfix builds: upgrade to 11.2.10-h15 or 11.2.16 or later.
11.2.5 through affected 11.2.7 hotfix builds: upgrade to 11.2.7-h21 or 11.2.16 or later.
11.2.0 through affected 11.2.4 hotfix builds: upgrade to 11.2.4-h22 or 11.2.16 or later.
PAN-OS 11.1
Affected: Releases before 11.1.16-h3, except the fixed maintenance releases identified below and subsequent fixed releases on those maintenance lines.
Fixed maintenance releases: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3.
Vendor upgrade paths:
11.1.14 through affected 11.1.16 hotfix builds: upgrade to 11.1.16-h3 or later.
11.1.11 through affected 11.1.13 hotfix builds: upgrade to 11.1.13-h15 or 11.1.16-h3 or later.
11.1.8 through affected 11.1.10 hotfix builds: upgrade to 11.1.10-h35 or 11.1.16-h3 or later.
Affected 11.1.7 builds: upgrade to 11.1.7-h11 or 11.1.16-h3 or later.
11.1.5 through affected 11.1.6 hotfix builds: upgrade to 11.1.6-h39 or 11.1.16-h3 or later.
11.1.0 through affected 11.1.4 hotfix builds: upgrade to 11.1.4-h37 or 11.1.16-h3 or later.
PAN-OS 10.2
Affected: Releases before 10.2.18-h12, except the fixed maintenance releases identified below and subsequent fixed releases on those maintenance lines.
Fixed maintenance releases: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 and 10.2.18-h12.
Vendor upgrade paths:
10.2.17 through affected 10.2.18 hotfix builds: upgrade to 10.2.18-h12 or later.
10.2.14 through affected 10.2.16 hotfix builds: upgrade to 10.2.16-h11 or 10.2.18-h12 or later.
10.2.11 through affected 10.2.13 hotfix builds: upgrade to 10.2.13-h26 or 10.2.18-h12 or later.
10.2.8 through affected 10.2.10 hotfix builds: upgrade to 10.2.10-h41 or 10.2.18-h12 or later.
10.2.0 through affected 10.2.7 hotfix builds: upgrade to 10.2.7-h38 or 10.2.18-h12 or later.
Version guidance: A fixed hotfix applies to its corresponding maintenance line; do not assume every numerically higher release elsewhere in the branch is fixed. Match the installed build to the vendor's Product Status and Solution tables. The upgrade paths above apply to affected builds, not builds already at or beyond the applicable fixed hotfix on that maintenance line.
Vulnerability Breakdown
CVE-2026-0322 – PAN-OS management interface authenticated remote code execution
Severity: High; vendor-suggested urgency Highest.
Vendor-published CVSS v4.0: 8.6 for network-accessible management exposure. The vendor also publishes 8.5 for the restricted jump-box scenario.
Description: Improper control of code generation, CWE-94, in the PAN-OS management interface enables authenticated remote code execution.
Impact: Arbitrary code execution with root privileges on the firewall, with high confidentiality, integrity and availability impact in the vendor's CVSS vector.
Conditions: An authenticated attacker requires high privileges and network access to the management interface. No user interaction or special configuration is required.
Exploitation status: Palo Alto Networks reports very limited exploitation targeting the management interface.
Mitigation
Apply the relevant fixed release as soon as possible. Use the branch- and maintenance-specific upgrade paths above and the official vendor advisory. Move older unsupported deployments to a supported fixed version.
Restrict management access. Allow only trusted internal IP addresses, following the vendor's management-access hardening guidance. The vendor also recommends restricting management access to a jump box as the only permitted source. These controls reduce risk; they do not remediate the vulnerability.
Do not rely on a workaround instead of patching. Palo Alto Networks states that no known workarounds exist for this issue.
Use Threat Prevention only as a limited supplementary control. Customers with a Threat Prevention subscription can enable Threat IDs 510046 and 510047, available in Applications and Threats content version 9159-10287 or later. These signatures do not provide complete coverage against all attack variations.
For Threat Prevention coverage to apply, the vendor requires all of the following:
Route incoming traffic for the management (MGT) port through a data-plane (DP) port, for example by enabling a management profile on a DP interface for management access.
Replace the certificate for inbound traffic management.
Decrypt inbound traffic to the management interface so the firewall can inspect it.
Enable Threat Prevention on inbound traffic to management services.
SSL decryption is required. Enabling the Threat IDs alone is not sufficient. Follow the vendor's implementation guidance and upgrade to an unaffected release even where these controls are in place.
Indicators associated with reported threat activity
Palo Alto Networks lists the following IP addresses as associated with threat activity and limited exploit attempts targeting this vulnerability:
66[.]42[.]72[.]14208[.]83[.]239[.]114149[.]248[.]47[.]234
As an operational follow-up, review management-access and security logs for activity involving these indicators and investigate suspicious administrative access. An indicator match alone does not confirm compromise, and the absence of these IP addresses does not establish that a system is unaffected. The addresses above are the indicators published in the vendor advisory, not an exhaustive detection list.
Summary for IT Teams
Products: PAN-OS on PA-Series and VM-Series firewalls and Panorama, including virtual and M-Series deployments. Cloud NGFW and Prisma Access are not affected.
Threat level: High, CVSS v4.0 8.6, with vendor-suggested urgency Highest and very limited exploitation reported. Exploitation requires authenticated, high-privileged access to a reachable management interface.
Action required: Identify affected builds, prioritise internet-accessible management interfaces, apply the appropriate fixed release and restrict management access to trusted internal sources. Treat Threat Prevention as limited additional protection, not a substitute for patching.
Reference
Need Help?
If your organisation needs assistance assessing exposure, planning remediation or investigating potential compromise, contact the Secure ISS SOC team on 1300 769 460 or email soc@secure-iss.com.bersecurity posture.
