Palo Alto Networks fixes exploited root-level flaw in PAN-OS

Palo Alto Networks fixes exploited root-level flaw in PAN-OS

14 October 2026: Palo Alto Networks has patched CVE-2026-0322, a high-severity code-injection flaw (CVSS 8.6) in the PAN-OS management interface that lets an authenticated attacker with network access run code as root on the firewall. The company says it has seen very limited exploitation, lists no workaround, and tells customers to upgrade to a fixed release.

Who is exposed

The advisory covers PAN-OS on PA-Series and VM-Series firewalls and on Panorama, both virtual and M-Series. Cloud NGFW and Prisma Access are not affected. No special configuration is needed to be vulnerable, so every unpatched release in the affected lines counts.

The attacker must hold valid credentials and be able to reach the management interface over the network. That is why Palo Alto rates the risk highest where the interface is open to the internet, and why it points to its own deployment guidance: allow management access only from trusted internal addresses, or from a single jump box. Restricting access to a jump box lowers the score to 8.5 in the company's own scoring. Palo Alto says it discovered the flaw internally.

Fixed versions by release line

The advisory sets a different first fixed hotfix for each maintenance release. The newest build in each line is:

• PAN-OS 12.2: 12.2.4
• PAN-OS 12.1: 12.1.10-h2
• PAN-OS 11.2: 11.2.16, listed as expected on 15 October
• PAN-OS 11.1: 11.1.16-h3
• PAN-OS 10.2: 10.2.18-h12

Older maintenance releases have their own hotfixes. For example, 11.2.13 needs 11.2.13-h3 and 10.2.10 needs 10.2.10-h41. Any other unsupported PAN-OS version must move to a supported fixed release. Because 11.2.16 was not out when the advisory appeared, teams on the 11.2 line who cannot wait should take the matching hotfix for their maintenance release.

Limited protection if you cannot patch today

Customers with a Threat Prevention subscription can switch on Threat IDs 510046 and 510047, available from Applications and Threats content version 9159-10287 onward. Palo Alto calls the coverage limited and warns that variations of the attack may not be detected. The signatures also need the management traffic to pass through a data-plane port, with inbound decryption and threat prevention enabled.

What is known about the attacks

Palo Alto published three IP addresses tied to the exploit attempts: 66.42.72.14, 208.83.239.114 and 149.248.47.234. BleepingComputer reports that it asked the company when exploitation began and who is behind it, and had not had an answer when it published. The advisory itself gives no start date.

Our network security software category lists six products.

Sources

• Palo Alto Networks: CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface, 14 October 2026
• BleepingComputer: Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks, 14 October 2026