Palo Alto patches exploited PAN-OS RCE CVE-2026-0322

Palo Alto Networks patched CVE-2026-0322, an authenticated remote code execution flaw in the PAN-OS management interface, and says it has already seen the bug used in attacks. The vendor advisory, security.paloaltonetworks.com/CVE-2026-0322, rates it CVSS 4.0 8.6 and sets exploit maturity to "Attacked." If your firewall's management interface is reachable from untrusted networks, treat this as same-day work.

What the bug does

The flaw is a code-injection issue (CWE-94) in the management interface. The CVSS vector — CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H — tells the real story: network-reachable, low complexity, but privileges required: high. An attacker needs valid admin credentials and network access to the management interface to reach it. That caveat is why the score lands at 8.6 rather than critical, and why internet-exposed or flat-network management planes are the exposure that matters.

Affected versions

Per Palo Alto's advisory, the flaw affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series appliances). Cloud NGFW and Prisma Access are not affected.

Fixes ship across the 10.2, 11.1, 11.2, 12.1 and 12.2 trains. The top-of-train fixed releases:

• 12.2.4 or later
• 12.1.10-h2 or later
• 11.2.16 or later — listed with an ETA of October 15, so GA was not yet available at disclosure; earlier 11.2 branches have hotfix fixes (e.g., 11.2.13-h3, 11.2.7-h21)
• 11.1.16-h3 or later
• 10.2.18-h12 or later

The advisory's solution table lists hotfix-level fixes for every supported maintenance branch — check it for the exact build matching your deployment rather than jumping trains.

Exploitation status

Palo Alto states: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." The company credits its own Suraj Siddharudh with finding the bug internally. BleepingComputer reports CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog with an October 17 remediation deadline for federal civilian agencies.

There are no workarounds. Palo Alto notes Threat Prevention Threat IDs 510046 and 510047 give limited coverage against known patterns, and only where SSL decryption is enabled.

BleepingComputer's reporting lists the following source IPs seen in exploitation attempts:

66.42.72[.]14
208.83.239[.]114
149.248.47[.]234

Action checklist

1. Confirm your exposure first. Check whether the management interface is reachable from the internet or any untrusted segment. That is the condition that turns this from "patch soon" into "patch now."
2. Restrict the management interface to trusted internal IPs, per Palo Alto's long-standing guidance. Do this even before you patch.
3. Upgrade to the fixed build for your train (above). If you run 11.2.14–11.2.15 and 11.2.16 GA isn't posted yet, move to the hotfix branch fix rather than waiting.
4. Hunt for the source IPs above and review management-plane admin activity and config changes for anomalies.
5. Rotate admin credentials if the interface was exposed — the exploit path assumes an authenticated attacker.

Context

This is the same failure mode Palo Alto keeps warning about: an exposed management plane turning a privileges-required bug into an internet-facing RCE. It echoes the CVE-2024-0012 / CVE-2024-9474 management-interface chain that drove the "get the interface off the internet" advisories, and arrives weeks after the GlobalProtect auth-bypass CVE-2026-0257 tied to Qilin ransomware. The pattern holds: PAN-OS boxes are high-value, and the management interface should never be the thing an attacker can reach first.