CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability

The flaw is code injection (CWE-94) in the PAN-OS management interface. The attacker must be able to reach that interface and must hold a valid administrative login (the CVSS vector requires high privileges). With that, they get code execution as root on the firewall.

Root on a firewall or on Panorama is a serious position. The attacker can change policy, read configuration and stored credentials, and watch traffic. Panorama manages many firewalls, so one compromise can spread.

The risk is highest when the management interface faces the internet. Palo Alto Networks says restricting it to trusted internal IP addresses minimizes the risk. Stolen or weak admin credentials combined with an exposed interface make exploitation practical. Cloud NGFW and Prisma Access are not affected.

PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Branches 12.2, 12.1, 11.2, 11.1 and 10.2 are affected, and so are older unsupported versions. Per branch, versions before these are affected:

• 12.2: 12.2.4
• 12.1: 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2
• 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 or 11.2.16
• 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 or 11.1.16-h3
• 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12

The advisory gives no version-check procedure, so compare the running PAN-OS version shown on the device against the list above. Also check whether the management interface is reachable from untrusted networks.

Upgrade to the fixed build for your train, or later: 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12. The advisory's Solution table maps each release range to its fix. Unsupported versions must move to a supported fixed one.

There is no known workaround. Partial mitigations from the advisory:

• Restrict management access to trusted internal IPs or a single jump box.
• With a Threat Prevention subscription, enable Threat IDs 510046 and 510047 (Applications and Threats content 9159-10287 or later). Coverage is limited and needs SSL Decryption.
• Route inbound management traffic through a data plane port with a management profile, replace its certificate, decrypt it and enable threat prevention on it.

CISA added it to KEV on 2026-10-14, due 2026-10-17 for US federal agencies. The required action is to apply vendor mitigations under BOD 26-04 and follow CISA's forensics triage requirements.

The advisory names three IP addresses tied to exploit attempts. Search management-interface and firewall logs for traffic to or from them:

• 66[.]42[.]72[.]14
• 208[.]83[.]239[.]114
• 149[.]248[.]47[.]234

Also review recent administrator logins and configuration changes for activity you did not make, and look for management-interface access from addresses outside your trusted ranges. The advisory gives no file or log-line indicators beyond the IP addresses.

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma® Access are not impacted by this vulnerability.