8 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
CVE-2026-0322 is a high-severity code injection vulnerability affecting the management interface of Palo Alto Networks PAN-OS, including PA-Series and VM-Series firewalls and Panorama appliances.
An authenticated attacker with high privileges and network access to the management interface can exploit the vulnerability to execute arbitrary code with root privileges. No special configuration is required for an appliance running an affected PAN-OS version to be vulnerable.
Palo Alto Networks has confirmed limited exploitation in the wild, and CISA has added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) Catalog. Fixed versions are available across affected PAN-OS release branches. Organizations should upgrade affected appliances, restrict management interface access to trusted networks, and review logs for indicators of exploitation.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
Authenticated Remote Code Execution in the PAN-OS Management Interface
Identifier
CVE-2026-0322
PoC or Exploitation
Confirmed exploited. Palo Alto Networks states that very limited exploitation has been observed targeting the PAN-OS management interface. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog.
CVSS Score
8.6 (High, CVSS v4.0)
Palo Alto Networks has released fixed versions. No workaround is available.
Affected versions include:
PAN-OS 12.2 releases before 12.2.4
PAN-OS 12.1 releases before 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2, depending on the minor release
PAN-OS 11.2 releases before 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16, depending on the minor release
PAN-OS 11.1 releases before 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3, depending on the minor release
PAN-OS 10.2 releases before 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, or 10.2.18-h12, depending on the minor release
The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama, both virtual and M-Series. No special configuration is required to be affected.
Cloud NGFW and Prisma Access are not affected.
Fixed versions include: PAN-OS 12.2: 12.2.4 or laterPAN-OS 12.1: 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2 or laterPAN-OS 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16 or laterPAN-OS 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3 or laterPAN-OS 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, or 10.2.18-h12 or later
Palo Alto Networks Security Advisory:https://security.paloaltonetworks.com/CVE-2026-0322
Description:
CVE-2026-0322 is a code injection vulnerability in the management interface of PAN-OS.
An authenticated attacker with network access to the management interface can exploit it to execute arbitrary code with root privileges on the firewall. The attacker must hold high privileges.
Mitigation Recommendation:
Upgrade every affected firewall and Panorama appliance to a fixed release. Choose the fix that matches the current minor release using Palo Alto Networks' advisory. Confirm that release 11.2.16 is available before planning an upgrade to it.
Restrict access to the management interface to trusted internal IP addresses only.
Identify all PA-Series, VM-Series, and Panorama deployments. Verify the PAN-OS version on each, and confirm whether its management interface is reachable from untrusted networks.
Search available logs for connections from the following IP addresses which Palo Alto Networks associates with exploit attempts against this vulnerability: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234.
