Palo Alto PAN-OS RCE Vulnerability CVE-2026-0322 Actively Exploited in the Wild
Do Son 
TL;DR
Palo Alto Networks disclosed CVE-2026-0322, a high-severity Palo Alto PAN-OS RCE flaw in the firewall management interface. Attackers are exploiting this in the wild. Rated 8.6 on the CVSS v4.0 scale, this Palo Alto PAN-OS RCE vulnerability lets authenticated attackers execute arbitrary code with root privileges. Therefore, administrators must install the latest PAN-OS maintenance updates and restrict management interface access immediately.
- CVE: CVE-2026-0322 R
- CVSS: 8.6 (High · CVSSv4)
- Impact: CWE-94
- Status: Exploited in the wild
- Action: See vendor advisory
Why CVE-2026-0322 Matters for Network Defenders
Enterprise networks rely on PA-Series, VM-Series, and Panorama appliances to enforce perimeter and internal segmentation policies. However, according to the security advisory, “very limited exploitation has been observed targeting the Palo Alto Networks management interface.” Furthermore, the vendor assigned its highest provider urgency rating (Red) and warned that “the risk is highest when you allow access to the management interface from external IP addresses on the internet.” Although real-world attacks are underway, no public proof-of-concept exploit code has been confirmed.
How the Palo Alto PAN-OS RCE Attack Works
Authenticated Management Interface Code Injection
Discovered internally by Suraj Siddharudh and tracked under CWE-94 and CAPEC-242, the vulnerability stems from improper control of code generation in the web management interface. Specifically, the advisory states that “a remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.” No special configuration is required for a device to be vulnerable.
Affected Products and Versions
While Cloud NGFW and Prisma Access are unaffected, the flaw impacts PA-Series, VM-Series, and Panorama (virtual and M-Series) running the following branches:
- PAN-OS 12.2: 12.2.0 through 12.2.3
- PAN-OS 12.1: 12.1.2 through 12.1.10-h1
- PAN-OS 11.2: 11.2.0 through 11.2.15
- PAN-OS 11.1: 11.1.0 through 11.1.16-h2
- PAN-OS 10.2: 10.2.0 through 10.2.18-h10, plus all older unsupported PAN-OS versions
Patch Details and Mitigation Steps
Because “no known workarounds exist for this issue,” administrators should upgrade to patched releases right away. The upgrades include PAN-OS 12.2.4, 12.1.10-h2 (or 12.1.7-h8 / 12.1.4-h12), 11.2.16 (or 11.2.13-h3 / 11.2.10-h15 / 11.2.7-h21 / 11.2.4-h22), 11.1.16-h3 (or 11.1.13-h15 / 11.1.10-h35 / 11.1.7-h11 / 11.1.6-h39 / 11.1.4-h37), and 10.2.18-h12 (or 10.2.16-h11 / 10.2.13-h26 / 10.2.10-h41 / 10.2.7-h38). Additionally, teams should restrict management access to trusted internal jump boxes. Customers with a Threat Prevention subscription can also enable Threat IDs 510046 and 510047 (content version 9159-10287 or later). This applies with SSL decryption on management traffic routed through a data plane port.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
