Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

Summary

Palo Alto Networks has disclosed CVE-2026-0322, a high-severity remote code execution (RCE) vulnerability affecting the management interface of PAN-OS software. The vulnerability carries a CVSS score of 8.6 and could allow an authenticated attacker with network access to execute arbitrary code with root privileges on a vulnerable firewall. Palo Alto Networks has confirmed very limited exploitation involving attacks targeting the management interface. The vulnerability affects PA-Series and VM-Series firewalls running affected PAN-OS releases, as well as Panorama appliances in virtual and M-Series deployments. Organizations should prioritize upgrading to a fixed software release and restrict management interface access to trusted internal systems.

Vulnerability Details

CVE ID	Severity	CVSS Score	Vulnerability Type
CVE-2026-0322	High	8.6	Remote Code Execution/ Code Injection

Technical Detail

CVE-2026-0322 is associated with improper control of code generation (CWE-94) in the management interface of Palo Alto Networks PAN-OS. Under the conditions described in the security advisory, an authenticated attacker who can reach the affected management interface may be able to exploit this weakness to execute attacker-controlled code on the underlying system. A key concern is the privilege level at which the resulting code can execute. According to the vulnerability description, successful exploitation could provide root-level code execution on the affected firewall. Root privileges represent the highest level of system access, potentially allowing an attacker to perform privileged operations beyond those available to a standard user. Depending on the actions performed after exploitation, this could threaten the integrity of the firewall, its configuration, and the security functions it provides.

Exploitation requires network access to the management interface and authentication. Consequently, exposure depends in part on how administrative access is configured and restricted. Management interfaces reachable from untrusted networks may provide a more accessible attack surface than interfaces isolated behind dedicated management networks and access controls. Organizations should therefore assess both the PAN-OS software version and the accessibility of the management interface when evaluating their exposure.

The vulnerability affects supported deployment types identified in the vendor advisory, including PA-Series and VM-Series firewalls and Panorama appliances in virtual and M-Series deployments. Palo Alto Networks has reported very limited exploitation targeting the management interface. Although this does not establish widespread compromise, the potential for root-level code execution makes prompt remediation important. Cloud NGFW and Prisma Access are identified as unaffected by this vulnerability.

Affected Versions

Product / Software Branch	Affected Versions	Fixed Version
PAN-OS 12.2	12.2.0 through 12.2.3	Upgrade to 12.2.4 or later.
PAN-OS 12.1	12.1.8 through 12.1.10-h*	Upgrade to 12.1.10-h2 or later.
	12.1.5 through 12.1.7-h*	Upgrade to 12.1.7-h8 or 12.1.10-h2 or later.
	12.1.2 through 12.1.4-h*	Upgrade to 12.1.4-h12 or 12.1.10-h2 or later.
PAN-OS 11.2	11.2.14 through 11.2.15	Upgrade to 11.2.16 or later.
	11.2.11 through 11.2.13-h*	Upgrade to 11.2.13-h3 or 11.2.16 or later.
	11.2.8 through 11.2.10-h*	Upgrade to 11.2.10-h15 or 11.2.16 or later.
	11.2.5 through 11.2.7-h*	Upgrade to 11.2.7-h21 or 11.2.16 or later.
	11.2.0 through 11.2.4-h*	Upgrade to 11.2.4-h22 or 11.2.16 or later.
PAN-OS 11.1	11.1.14 through 11.1.16-h*	Upgrade to 11.1.16-h3 or later.
	11.1.11 through 11.1.13-h*	Upgrade to 11.1.13-h15 or 11.1.16-h3 or later.
	11.1.8 through 11.1.10-h*	Upgrade to 11.1.10-h35 or 11.1.16-h3 or later.
	11.1.7 through 11.1.7-h*	Upgrade to 11.1.7-h11 or 11.1.16-h3 or later.
	11.1.5 through 11.1.6-h*	Upgrade to 11.1.6-h39 or 11.1.16-h3 or later.
	11.1.0 through 11.1.4-h*	Upgrade to 11.1.4-h37 or 11.1.16-h3 or later.
PAN-OS 10.2	10.2.17 through 10.2.18-h*	Upgrade to 10.2.18-h12 or later.
	10.2.14 through 10.2.16-h*	Upgrade to 10.2.16-h11 or 10.2.18-h12 or later.
	10.2.11 through 10.2.13-h*	Upgrade to 10.2.13-h26 or 10.2.18-h12 or later.
	10.2.8 through 10.2.10-h*	Upgrade to 10.2.10-h41 or 10.2.18-h12 or later.
	10.2.0 through 10.2.7-h*	Upgrade to 10.2.7-h38 or 10.2.18-h12 or later.

Note: The fixed release depends on the installed minor version and maintenance branch. Administrators should consult the official Palo Alto Networks security advisory before selecting an upgrade. Older unsupported PAN-OS versions should be upgraded to a supported fixed release. CVE-2026-0322 does not affect Cloud NGFW or Prisma Access.

Indicators of Compromise (IoCs)

The following IP addresses have been associated with threat activity and limited exploitation attempts targeting CVE-2026-0322.

• • 66[.]42[.]72[.]14
• • 208[.]83[.]239[.]114
• • 149[.]248[.]47[.]234

MITRE ATT&CK Mapping

Technique ID	Technique Name	Tactic ID	Tactic
T1210	Exploitation of Remote Services	TA0001	Initial Access
T1059	Command and Scripting Interpreter	TA0002	Execution
T1068	Exploitation for Privilege Escalation	TA0004	Privilege Escalation

Mitigation and Recommendations

• 1. Apply security updates: Upgrade affected PAN-OS installations to the latest available version. Prioritize internet-accessible management interfaces and other high-risk deployments.
• 2. Restrict management interface access: Allow access only from trusted internal IP addresses. Where possible, restrict management access to a dedicated jump host and prevent direct access from the public internet.
• 3. Investigate suspicious activity: Review management interface access logs, authentication events, firewall logs, and relevant network telemetry for activity associated with the published indicators of compromise.
• 4. Verify account and administrative activity: Investigate unusual administrative sessions, unexpected configuration changes, and suspicious activity on affected appliances. Follow incident response procedures if unauthorized access or possible root-level compromise is identified.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.