Active Exploitation of Remote Code Execution Vulnerability in Palo Alto Network's PAN

CVE-2026-0322 could allow an authenticated attacker to execute arbitrary code with root privileges on the firewall

CVE-2026-0322 could allow an authenticated attacker to execute arbitrary code with root privileges on the firewall

The following platforms are known to be affected:

Palo Alto Networks PAN-OS

Active Exploitation of CVE-2026-0322

Palo Alto Networks are reporting active exploitation of CVE-2026-0322 in the wild, and the US Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.

The NHS England National CSOC assesses further exploitation as highly likely.

Palo Alto Networks has released a security advisory to address a high severity vulnerability in PAN-OS. Successful exploitation could allow an authenticated attacker with network access to execute arbitrary code with root privileges on an affected firewall.

CVE‑2026‑0322 – 'Code Injection' vulnerability – CVSSv4 Score: 8.6

Affected organisations are encouraged to review the CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface advisory and apply the relevant update as soon as possible.

Organisations are encouraged to restrict access to the management interface to only trusted internal IP addresses according to Palo Alto's recommended best practice deployment guidelines .

Definitive source of threat updates

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Last edited: 15 October 2026 12:04 pm