Palo Alto patches a PAN-OS RCE already under limited attack
CVE-2026-0322 lets an authenticated attacker run code as root on PA-Series and VM-Series firewalls through the management interface. CISA has added it to its exploited list.
Palo Alto Networks disclosed CVE-2026-0322 on 14 October, a code injection bug in the PAN-OS management interface that lets an authenticated attacker with network access run arbitrary code as root. The company says it has observed very limited exploitation in the wild, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue the same day, with a 17 October deadline for federal agencies.
It carries a CVSS 4.0 score of 8.6 and hits PA-Series and VM-Series firewalls plus Panorama appliances, across PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 before 12.2.4. Cloud NGFW and Prisma Access are not affected. Palo Alto’s own advice, alongside patching, is to restrict management interface access to trusted internal addresses or a jump box, and to enable threat signatures 510046 and 510047 with SSL decryption as an interim mitigation.
Why it matters: this is a reminder that firewall management interfaces have no business facing the internet. Exploitation here still needs valid authentication first, so the bug is being chained from compromised credentials or another foothold rather than hit cold from the open internet.
The caveat: because it requires authentication, this is a lower-urgency bug than the unauthenticated NetScaler and Connect Secure flaws disclosed in the past fortnight. Patch it, but it is not the same class of emergency.