Palo Alto Networks PAN-OS: Remote code execution in management interface

Summary

A code injection flaw (CWE-94) in the management interface of PAN-OS on PA-Series and VM-Series firewalls and on Panorama allows an authenticated attacker with network access to run arbitrary code with root privileges on the device. Cloud NGFW and Prisma Access are not affected. Exploitation requires valid high-privilege credentials, and the vendor reports very limited active exploitation. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.

Affected

• PAN-OS 12.2.0 to below 12.2.4
• PAN-OS 12.1.0 to below 12.1.10-h2 (builds listed per branch in the vendor advisory)
• PAN-OS 11.2.0 to below 11.2.16
• PAN-OS 11.1.0 to below 11.1.16-h3
• PAN-OS 10.2.0 to below 10.2.18-h12
• Older, unsupported PAN-OS versions: no fix available, upgrade to a supported fixed release
• Affected products: PA-Series and VM-Series firewalls, Panorama (virtual and M-Series)

Fixed in

• PAN-OS 12.2: upgrade to 12.2.4 or later
• PAN-OS 12.1: upgrade to 12.1.10-h2 or later (12.1.7-h8 and 12.1.4-h12 are also fixed builds for their branches)
• PAN-OS 11.2: upgrade to 11.2.16 or later (11.2.13-h3, 11.2.10-h15, 11.2.7-h21 and 11.2.4-h22 are also fixed builds for their branches)
• PAN-OS 11.1: upgrade to 11.1.16-h3 or later
• PAN-OS 10.2: upgrade to 10.2.18-h12 or later
• Verify the exact build for each branch in the vendor advisory table before planning changes.

Workaround

• No known workarounds exist for this issue.
• Threat Prevention customers get limited coverage with Threat IDs 510046 and 510047 (content version 9159-10287 and later). Coverage is incomplete, and these Threat IDs require SSL Decryption and a specific traffic setup.
• Restrict management interface access to trusted internal IP addresses or a jump host, and do not expose it to the internet.

Exploitation

• Very limited exploitation has been observed targeting the Palo Alto Networks management interface.
• Added to the CISA KEV catalog on 2026-10-14; CISA set a remediation due date of 2026-10-17.
• Attack requires an authenticated attacker with network access and high privileges.
• Known to be used in ransomware campaigns: Unknown.

Our recommendation

• Patch all affected PAN-OS devices and Panorama to a fixed build from the vendor advisory without delay. Replace unsupported versions with a supported release.
• Until patched, restrict management access to trusted internal networks or a jump host and do not allow internet access to the management interface.
• Check whether the management interface was reachable from untrusted networks before patching, and review logs for unexpected administrator logins and configuration changes.
• Enforce multi-factor authentication and unique administrator accounts, and harden the administrator workstations used for firewall management.
• Follow the forensic triage guidance from CISA if the device was exposed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Ife-ella/CVE-vulnerability

Research sources

• Palo Alto Networks security advisory CVE-2026-0322 security.paloaltonetworks.com
• CISA KEV catalog entry CVE-2026-0322 www.cisa.gov
• CISA alert: four known exploited vulnerabilities added (14 Oct 2026) www.cisa.gov
• Help Net Security: CVE-2026-0322 exploited www.helpnetsecurity.com
• BleepingComputer: Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks www.bleepingcomputer.com
• SOC Prime: CVE-2026-0322 analysis socprime.com
• Kudelski Security research: PAN-OS management interface RCE kudelskisecurity.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:38.