CVE-2026-0322: Palo Alto Networks PAN-OS management-interface RCE (KEV)

CVE-2026-0322 is a code injection vulnerability in the PAN-OS management interface that lets an authenticated attacker with network access execute arbitrary code with root privileges on the firewall; Palo Alto Networks has observed very limited exploitation targeting the management interface, and CISA added it to KEV the day it was published.

CVE-2026-0322 is a code injection vulnerability (CWE-94) in the management interface of Palo Alto Networks PAN-OS. Palo Alto's own advisory describes it as a flaw that lets "an authenticated attacker with network access to the management web interface" execute "arbitrary code with root privileges on the firewall," and states that risk is "greatly reduced" by restricting management-interface access to trusted internal IP addresses, which Palo Alto has long recommended as a best practice (Palo Alto Networks Security Advisory CVE-2026-0322).

NVD lists the CVE as "Analyzed" and records its own CVSS v3.1 base score of 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H; Palo Alto's own advisory separately scores it 8.6 using CVSS v4.0, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red (NVD; Palo Alto Networks Security Advisory CVE-2026-0322).

Palo Alto's advisory states the vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and Panorama appliances when the management interface is exposed, with fixes in PAN-OS 10.2.18-h12, 11.1.16-h3, 11.2.16, 12.1.4-h12/12.1.7-h8/12.1.10-h2, and 12.2.4; Cloud NGFW and Prisma Access are not affected. It further reports that "very limited exploitation has been observed targeting the Palo Alto Networks management interface" and lists specific attacker-associated IP addresses customers should check their logs against (Palo Alto Networks Security Advisory CVE-2026-0322).

CISA added CVE-2026-0322 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-10-14, the same day it was published, with a required-action due date of 2026-10-17 and known ransomware use recorded as "Unknown," and directs agencies to CISA's BOD 26-04 forensic-triage guidance (CISA KEV).

As of 2026-10-25, FIRST scores the probability of exploitation at 0.0174 (77.559th percentile) (FIRST EPSS).

This is not an OT/ICS CVE; it is published here as a KEV-confirmed, actively exploited root-RCE affecting a widely deployed firewall management plane, meeting this page's indexing bar (NVD Analyzed status plus a real NVD CVSS) at a point when no fresher OT/ICS CVE had completed NVD analysis. Operators should patch to the fixed PAN-OS build and, regardless of patch status, ensure the management interface is not reachable from the internet.

• An authenticated attacker with network access to the PAN-OS management web interface can execute arbitrary code with root privileges on the firewall (CWE-94). — Palo Alto Networks Security Advisory CVE-2026-0322
• NVD status is "Analyzed" with an NVD-published CVSS v3.1 base score of 7.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H; Palo Alto separately scores it 8.6 under CVSS v4.0. — NVD
• Affects PAN-OS on PA-Series/VM-Series firewalls and Panorama when the management interface is exposed; fixed in 10.2.18-h12, 11.1.16-h3, 11.2.16, 12.1.4-h12/12.1.7-h8/12.1.10-h2, 12.2.4; very limited in-the-wild exploitation observed targeting the management interface. — Palo Alto Networks Security Advisory CVE-2026-0322
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-10-14 (same day as publication), due date 2026-10-17, known ransomware use recorded as "Unknown". — CISA KEV
• EPSS score is 0.0174 (77.559th percentile) as of 2026-10-25. — FIRST EPSS