PALO ALTO NETWORKS CONFIRMS LIMITED EXPLOITATION OF PAN

🚨 PALO ALTO NETWORKS CONFIRMS LIMITED EXPLOITATION OF PAN-OS MANAGEMENT RCE (CVE-2026-0322, CVSS 8.6)

Palo Alto Networks published an advisory on Oct 14, 2026 for CVE-2026-0322, an authenticated remote code execution flaw in the PAN-OS management interface. The vendor says very limited exploitation has been observed targeting the management interface.

• An authenticated attacker with network access to the management interface can run code as root on the firewall

• Privileges Required: HIGH (not unauthenticated)

• Affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series)

• Cloud NGFW and Prisma Access are not impacted

• CVSS 4.0: 8.6 · Urgency: HIGHEST · Exploit Maturity: ATTACKED

• No known workarounds; restrict management access to trusted systems (jump box)

Fixes: apply the branch-specific hotfix / upgrade from the advisory release matrix. PAN-OS 11.2.16 is listed with an October 15 ETA; other fixed builds are available now for applicable 12.2 / 12.1 / 11.2 / 11.1 / 10.2 branches.

Threat Prevention IDs 510046 and 510047 (content 9159-10287+) provide limited coverage only when management traffic is decrypted and inspected — they do not replace upgrading.

Authentication and high privileges are required. Neither widespread exploitation nor exploitation before patch availability is established. Independent telemetry, actor attribution and victim counts were not found. The vendor shared three IPs associated with limited exploit attempts; treat those as unconfirmed IoCs until you validate them in your own telemetry.

security.paloaltonetworks.com/CVE-2026-0322