--- id: "CVE-2026-0322" kind: "vulnerability" aliases: ["CVE-2026-0322"] title: "paloaltonetworks pan-os: A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS\u00ae software\u2026" severity: "high" cvss: 8.6 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Palo Alto Networks PAN-OS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "PAN-OS", "fixed": ["12.2.4", "12.1.4-h12", "12.1.7-h8", "12.1.10-h2", "11.2.4-h22", "11.2.7-h21", "11.2.10-h15", "11.2.13-h3", "11.2.16", "11.1.4-h37", "11.1.6-h39", "11.1.7-h11", "11.1.10-h35", "11.1.13-h15", "11.1.16-h3", "10.2.7-h38", "10.2.10-h41", "10.2.13-h26", "10.2.16-h11", "10.2.18-h12"], "affected": "< 12.2.4; < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2 (per line); < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16; < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3; < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["10.2.0"], "affected": "< 10.2.0", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": ["12.2.4"], "affected": ">= 12.2.0, < 12.2.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.7", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.8", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.9", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.10", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.11", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.12", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.13", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.14", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.15", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.16", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.17", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 10.2.18", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.0", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.1", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.2", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.3", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.5", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.6", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.7", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.8", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.9", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.10", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.11", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.12", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.13", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.14", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.15", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.1.16", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.0", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.1", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.2", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.3", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.4", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.5", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.6", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.7", "ecosystem": "vendor"}, {"name": "paloaltonetworks pan-os", "fixed": [], "affected": "= 11.2.8", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "firewall", "infrastructure", "palo-alto", "pan-os", "panorama", "self-hosted"] not_affected_if: ["cloud-ngfw", "managed-hosting", "prisma-access"] published_at: "2026-10-14T00:00:00+00:00" first_seen_at: "2026-10-23T19:11:50+00:00" updated_at: "2026-10-23T23:44:52+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:34:49+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0322", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # paloaltonetworks pan-os: A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software… Authenticated RCE as root in the PAN-OS management interface (PA-Series, VM-Series, Panorama). Needs admin-level access to the management interface, but no special configuration. Palo Alto reports very limited exploitation. Risk is highest when the management interface is reachable from the internet. Cloud NGFW and Prisma Access are not affected. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Palo Alto Networks PAN-OS affected ? fixed ? - vendor:PAN-OS affected < 12.2.4; < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2 (per line); < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16; < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3; < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12 fixed 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12 - vendor:paloaltonetworks pan-os affected < 10.2.0 fixed 10.2.0 - vendor:paloaltonetworks pan-os affected >= 12.2.0, < 12.2.4 fixed 12.2.4 - vendor:paloaltonetworks pan-os affected = 10.2.7 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.8 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.9 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.10 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.11 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.12 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.13 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.14 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.15 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.16 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.17 fixed ? - vendor:paloaltonetworks pan-os affected = 10.2.18 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.0 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.1 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.2 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.3 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.4 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.5 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.6 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.7 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.8 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.9 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.10 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.11 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.12 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.13 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.14 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.15 fixed ? - vendor:paloaltonetworks pan-os affected = 11.1.16 fixed ? - vendor:paloaltonetworks pan-os affected = 11.2.0 fixed ? - vendor:paloaltonetworks pan-os affected = 11.2.1 fixed ? - vendor:paloaltonetworks pan-os affected = 11.2.2 fixed ? - vendor:paloaltonetworks pan-os affected = 11.2.3 fixed ? - vendor:paloaltonetworks pan-os affected = 11.2.4 fixed ? - vendor:paloaltonetworks pan-os affected = 11.2.5 fixed ? - vendor:paloaltonetworks pan-os affected = 11.2.6 fixed ? - vendor:paloaltonetworks pan-os affected = 11.2.7 fixed ? - vendor:paloaltonetworks pan-os affected = 11.2.8 fixed ? ## How to check Run 'show system info' on the firewall or Panorama and compare sw-version against the fixed list. Check whether the management interface is reachable from the internet or untrusted networks. Look for connections from 66.42.72.14, 208.83.239.114 and 149.248.47.234. ## Fix Upgrade to a fixed release: 12.2.4; 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 or 11.2.16; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 or 11.1.16-h3; 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12. Use the fix on your own minor-version line, or the newest line fix. No workarounds. Restrict the management interface to a jump box or trusted internal IPs. Threat IDs 510046 and 510047 give limited coverage and need SSL decryption. ## Timeline - 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322 - 2026-10-23T21:34:49+00:00 analyst — Read PAN's advisory (published 2026-10-14): CVSS-B 8.6, PR:H, CWE-94, very limited exploitation, three IoC IPs. No PoC checked; social search skipped. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-0322 ## Documents - [advisory] CVE-2026-0322 PAN-OS: Authenticated RCE in the Management Interface https://security.paloaltonetworks.com/CVE-2026-0322 - [mentions] CISA KEV: CVE-2026-0322 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322 ## From the sources A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_