CVE-2026-0322 — an authenticated remote code execution flaw scored 8.6 — allows an attacker with network access to execute arbitrary code as root via the PAN-OS management interface.
CVE-2026-0322: authenticated RCE in the PAN-OS management interface
Palo Alto Networks on Wednesday disclosed a high-severity vulnerability in PAN-OS it tracked as CVE-2026-0322 (CVSS score: 8.6). "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall," the company said. Palo Alto Networks also said no special configuration is required to exploit the issue, increasing the urgency for exposed management interfaces to be addressed.
Affected products and patched PAN-OS builds
The vulnerability impacts PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). The company explicitly stated that Cloud NGFW and Prisma Access are not affected.
- PAN-OS >= 12.2.4
- PAN-OS >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2
- PAN-OS >= 11.2.4-h22, >= 11.2.7-h21, >= 11.2.10-h15, >= 11.2.13-h3, >= 11.2.16 (ETA: October 15, 2026)
- PAN-OS >= 11.1.4-h37, >= 11.1.6-h39, >= 11.1.7-h11, >= 11.1.10-h35, >= 11.1.13-h15, >= 11.1.16-h3
- PAN-OS >= 10.2.7-h38, >= 10.2.10-h41, >= 10.2.13-h26, >= 10.2.16-h11, >= 10.2.18-h12
Palo Alto Networks credited Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, with discovering and reporting the vulnerability.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadObserved exploitation and U.S.-geolocated IPs
The company acknowledged it has seen "very limited exploitation" targeting the Palo Alto Networks management interface but declined to elaborate on the nature of the malicious activity, who is behind the effort, or when it began. Palo Alto Networks provided three IP addresses geolocated to the U.S. that it assessed were linked to exploit attempts:
- 66.42.72[.]14
- 208.83.239[.]114
- 149.248.47[.]234
Alongside the availability of patches, Palo Alto Networks advised reducing exposure by restricting access to trusted internal IP addresses and recommended, "You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface."
Concurrent Cisco advisory and CISA KEV listing
The disclosure arrived amid a separate Cisco warning that threat actors are exploiting a critical flaw in Cisco Secure Email Gateway tracked as CVE-2026-76519 (CVSS score: 9.8). Cisco said, "This vulnerability is due to improper handling of email attachments when the file reputation service is enabled," and that an attacker could exploit it "by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system."
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both CVE-2026-0322 and CVE-2026-76519 to its Known Exploited Vulnerabilities (KEV) catalog. CISA's KEV listing requires Federal Civilian Executive Branch (FCEB) agencies to prioritize fixes by October 17, 2026.
What this means for technologists, procurement leaders, and federal agencies
- Technologists and security teams: Apply the listed PAN-OS updates where applicable and, until patched, restrict management interface access to trusted internal IP addresses or a single jump box as Palo Alto Networks recommended.
- Affected enterprises and procurement leaders: Confirm whether PA-Series, VM-Series, or Panorama instances are in use and ensure patch windows include the specific PAN-OS builds listed; note that Cloud NGFW and Prisma Access do not require the same mitigation.
- Federal agencies (FCEB): With both CVE-2026-0322 and CVE-2026-76519 on CISA's KEV list, agencies must prioritize remediation by October 17, 2026, per the catalog requirement.
The immediate record is narrow but clear: an authenticated flaw that yields root on firewalls, a parallel critical mail-gateway defect, and a CISA deadline that compresses remediation timelines for federal bodies. For organizations running the affected PAN-OS builds, the choice is binary and time-sensitive — apply the vendor patches, restrict management access, or accept the elevated risk while exploit attempts, even if "very limited," have already been observed.
