Vulnerability details

CVE-2026-0322

Actively exploited

Palo Alto Networks PAN-OS

PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

CVSS 4.0

8.6High

Official description

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

CVSS scores

Score	Version	Source	Vector
8.6High	4.0	CVEProject cvelistV5 (CNA) (palo_alto)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red`

Affected products

Vendor	Product	Versions	Source
Palo Alto Networks	PAN-OS	10.2.0 ≤ v < 10.2.18-h12	CVEProject cvelistV5 (CNA)
Palo Alto Networks	PAN-OS	11.1.0 ≤ v < 11.1.16-h3	CVEProject cvelistV5 (CNA)
Palo Alto Networks	PAN-OS	11.2.0 ≤ v < 11.2.16	CVEProject cvelistV5 (CNA)
Palo Alto Networks	PAN-OS	12.1.0 ≤ v < 12.1.10-h2	CVEProject cvelistV5 (CNA)
Palo Alto Networks	PAN-OS	12.2.0 ≤ v < 12.2.4	CVEProject cvelistV5 (CNA)

References and advisories

https://security.paloaltonetworks.com/CVE-2026-0322 vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322 government-resource

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-14
Last updated: 2026-10-15
State: Published
Assigner (CNA): palo_alto
Kolun priority: 82 · Critical

CISA KEV catalog

Date added: 2026-10-14
Due date: 2026-10-17
Used in ransomware: Unknown

Exploit prediction (EPSS)

1.74%

Probability of exploitation in 30 days

77.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-94
Improper Control of Generation of Code ('Code Injection')