Palo Alto Networks published CVE-2026-0322 Wednesday at 16:00 UTC (9 AM PT). It is a code injection bug (CWE-94) in the PAN-OS management interface that lets an authenticated attacker with network access run arbitrary code with root privileges on the firewall. PAN scores it CVSS-B 8.6 (High) with suggested urgency Highest and exploit maturity marked Attacked. The advisory says very limited exploitation has been observed targeting the management interface. PAN found the bug internally and credits Suraj Siddharudh. Victim count: Undisclosed. Actor: Undisclosed.
Who is exposed. PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series), across the 10.2, 11.1, 11.2, 12.1 and 12.2 trains. No special configuration is needed to be affected. Cloud NGFW and Prisma Access are not affected. The vector needs a high-privilege login (PR:H in the CVSS 4.0 string), which is why it scores 8.6 rather than critical. In practice that means an attacker who already holds admin credentials, or who can reach a management session some other way, gets a root shell on the box that sits in front of everything else. PAN rates the risk highest when the management interface accepts connections from external IPs and drops it to 8.5 when access is limited to a jump box.
KEV status. CISA added CVE-2026-0322 to KEV on Oct 14 with a due date of Oct 17 and flagged it for forensic triage under BOD 26-04. That is a three-day clock for federal agencies, the same one CISA set today for Cisco’s Secure Email Gateway CVE-2026-76519 and for two chained AhsayCBS bugs. Ransomware use: Unknown, per CISA.
The fix. Fixed builds: 12.2.4; 12.1.4-h12, 12.1.7-h8, 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3; 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12. One gap: boxes on 11.2.14 or 11.2.15 have to go to 11.2.16, which PAN lists with an ETA of Oct 15. Older unsupported PAN-OS versions need to move to a supported fixed release. PAN says no workaround exists.
The signatures, and why they don’t cover most shops. Threat Prevention customers get limited coverage from Threat IDs 510046 and 510047 (Applications and Threats content 9159-10287 and later). For those to fire, management traffic has to come in through a dataplane port with a management profile, use a replaced inbound management certificate, be decrypted, and have threat prevention applied. Most teams manage firewalls over the dedicated MGT port, where none of that happens. PAN itself says variants may get past the signatures and recommends upgrading.
What we’d do this afternoon. First, find every PAN-OS and Panorama management interface that answers from outside your admin network, including management profiles on dataplane interfaces, and restrict them to a jump box or trusted internal IPs. Then check management-plane system and configuration logs for logins or API calls from the three IPs PAN tied to exploit attempts: 66.42.72.14, 208.83.239.114 and 149.248.47.234. Because the bug needs a high-privilege login, a hit is also an admin credential incident: rotate firewall and Panorama admin passwords and API keys, review admin accounts you don’t recognize, and check whether those credentials are reused elsewhere. Pull config audit diffs for changes you can’t explain. Then patch in the order exposure dictates, with internet-facing management first and Panorama right behind it, since Panorama pushes config to the whole fleet. On a box you suspect was used, collect forensics before you upgrade.