CVE Alert: CVE-2026-0322 – Palo Alto Networks

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

**Risk verdict:** Urgent remediation is warranted: exploitation is marked active, although the advisory describes observed activity as very limited; KEV listing and EPSS data are not provided.

**Why this matters:** Successful execution as root could let an attacker alter firewall policy, disrupt traffic, or use the device as a foothold to reach internal systems. Because these appliances sit at network boundaries, compromise may also expose sensitive management data and undermine security controls.

**Most likely attack path:** The attacker needs network access to the management interface and a high-privilege authenticated account; no user interaction or special conditions are indicated. Internet-reachable management access raises exposure, while restricting it to trusted administration hosts reduces reachability. The stated impact is on the firewall itself; onward movement is a credible operational risk, not a stated scope change.

**Who is most exposed:** Organisations running affected on-premises or virtual firewalls, or Panorama deployments, are in scope. Prioritise devices whose management plane is internet-facing or broadly reachable from corporate networks.

Review management authentication and source-IP logs for unexpected privileged sessions.

Investigate unusual management requests, especially followed by administrative changes.

Check for unexpected processes, configuration changes, or outbound connections from appliances.

Hunt for suspicious access to management interfaces and correlate with jump-host activity.

Mitigation and prioritisation:

Apply the vendor’s fixed release for the installed branch; expedite for internet-exposed devices.

Restrict management access to trusted IPs and a dedicated jump host; remove public exposure.

Enable the specified threat signatures only with the required inspection path and SSL decryption; treat as defence-in-depth, not a fix.

Schedule upgrades with HA, configuration backup, and rollback checks; verify Panorama and managed devices separately.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.