Multiple vulnerabilities were identified in Palo Alto Products. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution, elevation of privilege, spoofing, cross-site scripting and security restriction bypass on the targeted system.
CVE-2026-0322 is being exploited in the wild. A remote code execution vulnerability in the management interface of PAN-OS software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. Hence, the risk level is rated as High Risk.
Remote Code Execution
Security Restriction Bypass
Elevation of Privilege
System / Technologies affected
PAN-OS 10.2 versions earlier than 10.2.7-h38
PAN-OS 10.2 versions earlier than 10.2.10-h41
PAN-OS 10.2 versions earlier than 10.2.13-h26
PAN-OS 10.2 versions earlier than 10.2.16-h11
PAN-OS 10.2 versions earlier than 10.2.18-h12
PAN-OS 11.1 versions earlier than 11.1.4-h37
PAN-OS 11.1 versions earlier than 11.1.4-h37 on Panorama
PAN-OS 11.1 versions earlier than 11.1.6-h39
PAN-OS 11.1 versions earlier than 11.1.6-h39 on Panorama
PAN-OS 11.1 versions earlier than 11.1.7-h11
PAN-OS 11.1 versions earlier than 11.1.7-h11 on Panorama
PAN-OS 11.1 versions earlier than 11.1.10-h35
PAN-OS 11.1 versions earlier than 11.1.10-h35 on Panorama
PAN-OS 11.1 versions earlier than 11.1.13-h15
PAN-OS 11.1 versions earlier than 11.1.13-h15 on Panorama
PAN-OS 11.1 versions earlier than 11.1.16-h3
PAN-OS 11.1 versions earlier than 11.1.16-h3 on Panorama
PAN-OS 11.2 versions earlier than 11.2.4-h22
PAN-OS 11.2 versions earlier than 11.2.4-h22 on Panorama
PAN-OS 11.2 versions earlier than 11.2.7-h21
PAN-OS 11.2 versions earlier than 11.2.7-h21 on Panorama
PAN-OS 11.2 versions earlier than 11.2.10-h15
PAN-OS 11.2 versions earlier than 11.2.10-h15 on Panorama
PAN-OS 11.2 versions earlier than 11.2.13-h3
PAN-OS 11.2 versions earlier than 11.2.13-h3 on Panorama
PAN-OS 11.2 versions earlier than 11.2.15 on Panorama
PAN-OS 11.2 versions earlier than 11.2.16
PAN-OS 12.1 versions earlier than 12.1.4-h12
PAN-OS 12.1 versions earlier than 12.1.4-h12 on Panorama
PAN-OS 12.1 versions earlier than 12.1.7-h8
PAN-OS 12.1 versions earlier than 12.1.7-h8 on Panorama
PAN-OS 12.1 versions earlier than 12.1.10-h2
PAN-OS 12.1 versions earlier than 12.1.10-h2 on Panorama
PAN-OS 12.1 versions earlier than 12.2.4
PAN-OS 12.1 versions earlier than 12.2.4 on Panorama
PAN-OS 12.2 versions earlier than 12.2.4
PAN-OS 12.2 versions earlier than 12.2.4 on Panorama
Prisma Access 10.2 versions earlier than 10.2.10-h41
Prisma Access 11.2 versions earlier than 11.2.7-h21
Prisma Access 12.1 versions earlier than 12.1.7-h8
GlobalProtect App 6.0 versions earlier than 6.0.15 on Windows
GlobalProtect App 6.2 versions earlier than 6.2.8-h15 (6.2.8-1084) on macOS
GlobalProtect App 6.2 versions earlier than 6.2.8-h15 (6.2.8-1084) on Windows
GlobalProtect App 6.3 versions earlier than 6.3.3-h16 (6.3.3-1199) on macOS
GlobalProtect App 6.3 versions earlier than 6.3.3-h16 (6.3.3-1199) on Windows
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor:
Vulnerability Identifier
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
