Palo Alto Networks Patches Authenticated RCE in PAN-OS Management Interface
Palo Alto Networks released updates for CVE-2026-0322, a high-severity flaw allowing authenticated attackers to execute code as root on firewalls.
Key points
- CVE-2026-0322 allows authenticated remote code execution with root privileges on PAN-OS management interfaces.
- Palo Alto Networks has released patched versions for PA-Series, VM-Series, and Panorama appliances.
- Cloud NGFW and Prisma Access services are not impacted by this vulnerability.
Palo Alto Networks disclosed CVE-2026-0322, a high-severity vulnerability in the management interface of its PAN-OS software. The flaw allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall, according to the vendor's security advisory.
At a glance
- CVE
- CVE-2026-0322
- Product
- Palo Alto Networks Cloud NGFW
- CVSS
- 8.6 High
- Weakness
- code injection
- Exploited
- No known exploitation
The vulnerability stems from improper control of code generation, classified as CWE-94. It affects PA-Series and VM-Series firewalls as well as Panorama virtual and M-Series appliances. Palo Alto Networks stated that very limited exploitation has been observed targeting this specific management interface.
Context and Background
The Common Vulnerability Scoring System rates the issue at 8.6, which is considered high severity. The base score reflects the potential for complete compromise of the device's confidentiality and integrity. Attackers do not require special configuration to exploit the issue, but they must first obtain valid credentials.
Palo Alto Networks noted that the risk is highest when organizations allow access to the management interface from external internet IP addresses. The vendor advises restricting access to trusted internal addresses to minimize exposure, aligning with its best practice deployment guidelines.
Who Is Affected
Affected versions include PAN-OS releases prior to 11.2.16, 11.1.16-h3, and 10.2.18-h12. Specific minor versions such as 11.2.4 through 11.2.13 and 11.1.4 through 11.1.13 are also vulnerable if not updated to the specified hotfix levels.
Cloud NGFW and Prisma Access services are not impacted by this vulnerability. Customers with Threat Prevention subscriptions can enable Threat IDs 510046 and 510047 for limited detection, provided they configure SSL decryption and route management traffic through data plane ports.
What should you do?
Palo Alto Networks recommends upgrading to the latest unaffected versions as soon as possible. For environments that cannot immediately upgrade, restricting management interface access to a single jump box can reduce the attack surface. Organizations should also verify that external IP addresses cannot reach the management port.
What to do and how to stay safe: Palo Alto Networks
- Verify if your PAN-OS version is listed in the affected range and schedule an upgrade to a patched release.
- Restrict access to the management interface to trusted internal IP addresses or a dedicated jump box.
- Enable Threat Prevention subscriptions and configure the specified Threat IDs if immediate patching is not possible.
- Monitor logs for authentication attempts from the IP addresses associated with known exploit activity.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does CVE-2026-0322 affect Palo Alto Networks Cloud NGFW?
No, Cloud NGFW and Prisma Access services are not impacted by this vulnerability.
What is the severity rating for this vulnerability?
The vulnerability is rated as high severity with a CVSS score of 8.6.
Has this vulnerability been exploited in the wild?
Palo Alto Networks reported that very limited exploitation has been observed targeting the management interface.
