Palo Alto Networks has fixed a code-injection vulnerability in the PAN-OS management interface that attackers are already exploiting. The bug, tracked as CVE-2026-0322, lets an authenticated attacker with network access to the management interface run arbitrary code with root privileges. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected.

The company published its advisory on October 14, 2026, and updated it on October 15. It lists exploit maturity as "ATTACKED" and says: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." The same day, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. The KEV entry, as recorded in NVD, sets a due date of October 17, 2026 for federal civilian agencies and requires them to apply vendor mitigations in line with Binding Operational Directive 26-04 and CISA's "Forensics Triage Requirements." CSO Online summarized that as an order to patch and check affected firewalls for compromise.

The flaw at a glance

  • CVE: CVE-2026-0322 (code injection, CWE-94)
  • Severity: Palo Alto rates it 8.6 (HIGH) on CVSS 4.0, or 8.5 when management access is limited to a jump box. NVD's own CVSS 3.1 score is 7.2 (HIGH).
  • Affected: PAN-OS on PA-Series and VM-Series firewalls, and on Panorama (virtual and M-Series)
  • Not affected: Cloud NGFW, Prisma Access
  • Preconditions: valid credentials and network access to the management interface
  • Status: exploited in the wild. Palo Alto calls the exploitation "very limited."
  • Workarounds: "No known workarounds exist for this issue," the advisory says

An attacker needs to log in before exploiting this flaw. That makes it harder to use than an unauthenticated bug, but the barrier is lower than it sounds. The advisory notes that "no special configuration is required to be affected by this issue," so any device whose management interface the attacker can reach with working credentials is exposed. Yih Khai Wong, senior research manager for security services at IDC Asia/Pacific, told CSO Online that "the entry point probably isn't the bug itself, but weak management-access hygiene." A successful exploit gives the attacker root on the device that enforces the network's security policy.

BleepingComputer reports that Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, discovered the vulnerability internally. BleepingComputer asked Palo Alto who is behind the attacks and when exploitation began, and reported no answer. Neither the advisory nor CISA's alert names a threat actor.

Timeline

  • October 14, 2026: Palo Alto Networks publishes the advisory for CVE-2026-0322, confirming limited exploitation and listing three IP addresses tied to the activity. CISA adds it to the KEV catalog with three other flaws: CVE-2026-76519 (Cisco Secure Email Gateway relative path traversal), CVE-2026-105133 (Ahsay AhsayCBS improper authentication) and CVE-2026-105134 (Ahsay AhsayCBS command injection).
  • October 15, 2026: Palo Alto updates the advisory as the PAN-OS 11.2.16 fix is published. BleepingComputer had reported that this fix was expected that day.
  • October 17, 2026: KEV due date for federal civilian agencies. The required action cites BOD 26-04 and CISA's forensics triage requirements. According to CSO Online, the entry lists ransomware use as "unknown."

The three-day deadline is now standard for KEV additions under BOD 26-04; the forensics-triage requirement is the part that matters. The requirement to check for compromise matters as much as the patch. The bug was exploited before every fix was available, so a device that is patched now may still have been compromised earlier.

Fixed releases

The advisory lists fixes for five PAN-OS branches. The versions below are copied from the vendor advisory:

  • PAN-OS 12.2: 12.2.4
  • PAN-OS 12.1: 12.1.4-h12, 12.1.7-h8, 12.1.10-h2
  • PAN-OS 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16
  • PAN-OS 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3
  • PAN-OS 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12

Most of these fixes are hotfixes on specific maintenance releases, and each applies to a specific range of versions. The advisory also allows moving to the newest fixed release in each branch. Devices on older, unsupported versions must be upgraded to a supported fixed release. Check which maintenance train a device runs before you pick an upgrade target, and confirm the target in the advisory itself. The advisory is the authoritative list and may change.

Detection coverage is partial

Palo Alto lists Threat Prevention signatures with Threat IDs 510046 and 510047, available to Threat Prevention subscribers from Applications and Threats content version 9159-10287. The advisory says coverage is limited, that variants may not be detected, and that detection requires SSL decryption. Do not treat the signatures as a substitute for patching. The advisory describes some mitigations that reduce risk only partly, such as decrypting and inspecting inbound management traffic. It also says no workaround exists, so no configuration change fully closes the hole on an unpatched device.

The company published three IP addresses tied to the observed exploitation:

  • 66.42.72[.]14
  • 208.83.239[.]114
  • 149.248.47[.]234

These are useful for searching back through logs. They are not a complete picture. Attackers can change infrastructure easily, so a clean search for these three addresses does not prove a device was untouched.

What It Means for Defenders

Patch first. Move every affected PA-Series, VM-Series and Panorama device to a fixed release for its branch, as listed above. Panorama manages the firewall fleet, so treat it with the same priority as the firewalls. The advisory says Cloud NGFW and Prisma Access require no action.

Restrict the management interface. Palo Alto recommends restricting management access to trusted internal IP addresses only, and BleepingComputer repeats that advice. The advisory's lower 8.5 score for jump-box-only access reflects the same idea. Management interfaces should not be reachable from the internet, and access from inside the network should go through a small number of controlled administrative hosts. This reduces exposure but does not fix the bug.

Assume you need to look for compromise. The vulnerability was exploited before fixes were available. IDC's Wong, quoted by CSO Online, advises defenders to:

  • trace who can reach the management interface from outside a trusted network
  • review admin login history for unusual activity
  • check firewall configurations for unexpected changes

Look for logins from unexpected sources, especially the three published IP addresses. Also look for admin sessions at unusual times and for configuration changes nobody can account for. As cybersecurity researcher and red teamer Vibhum Dubey told CSO Online, "Patching is only part of the response."

Rotate administrator credentials. Exploitation requires valid credentials, so any account that could log in to the management interface may be part of the attack path. Rotate passwords for PAN-OS and Panorama administrator accounts. Check that multi-factor authentication is enforced where possible. Remove dormant or shared admin accounts.

Federal agencies: The KEV due date of October 17, 2026, has passed. The required action covers both vendor mitigations and CISA's forensics triage requirements under BOD 26-04. Agencies that have patched but not completed triage have met only part of the requirement.

If you find signs of compromise, do not just patch and move on. An attacker with root on a firewall may have changed the configuration, collected credentials or set up persistence. Follow Palo Alto's guidance and your incident response process, and report as your sector or regulator requires.

What is still unknown

Palo Alto has not said publicly when the attacks started, who is behind them, or whether firewalls were compromised. Palo Alto did not immediately respond to CSO Online's request for comment. CSO Online reports that the KEV entry lists ransomware use as unknown. Expect updates to the advisory as the investigation continues.

Sources