cyfenced.com →

[ CVE-2026-0322 · Published 14 Oct 2026 ]

Code injection in PAN-OS management interface gives root on firewalls

Exploited · CISA KEV CVSS 7.2 EPSS 1%2 agency advisoriesNo fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-10-14

[ Analyst view ]Is this a red alert for you?

Patch within days

CISA lists it as exploited, but it needs administrator credentials and access to the management interface.

Red alert if
Your PAN-OS firewall or Panorama management interface is reachable from the internet or from untrusted networks.
Can wait if
The management interface is only reachable from a restricted management network, or you only use Cloud NGFW or Prisma Access.
What it is
A code injection flaw in the management interface of Palo Alto Networks PAN-OS lets an authenticated administrator with network access run code as root on PA-Series and VM-Series firewalls and on Panorama. Cloud NGFW and Prisma Access are not affected.
Impact
An attacker with administrator credentials and access to the management interface can take full control of the firewall. Control of a firewall or Panorama lets an attacker change security policy, watch traffic and move into the networks it protects.

How an attack would work MITRE ATT&CK

  1. T1078 Valid AccountsThe attacker uses stolen or weak administrator credentials for the management interface.
  2. T1059 Command and Scripting InterpreterThe injected code runs as root on the firewall.
  3. T1562 Impair DefensesFirewall policy and logging can be changed to let traffic through unseen.

What to do

  1. Upgrade PAN-OS to 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12 or later, as listed in Palo Alto Networks' advisory.
  2. Restrict the management interface to trusted internal addresses, as Palo Alto Networks recommends.
  3. Review administrator accounts and require multi-factor authentication for management access.
  4. Check configuration and system logs for changes you did not make.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

CISA: Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 17 Oct 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1326

    Multiple vulnerabilities in Palo Alto Networks products Translated from French

    Multiple vulnerabilities have been discovered in Palo Alto Networks products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service. Palo Alto…

    CVE-2026-87464CVE-2026-87646CVE-2026-87445+458 more CVEs
  • BSI CERT-BundWID-SEC-2026-3947

    Palo Alto Networks PAN-OS: Multiple vulnerabilities Translated from German

    CVE-2026-0317CVE-2026-0322CVE-2026-0318+4 more CVEs

[ References ]References