On October 14, 2026, NVD published CVE-2026-0322 and CISA added it to the KEV catalog the same day, with an October 17 deadline. It affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series): root code execution through the management interface.
The score is 7.2, only HIGH. Don't let that number reassure you: it's being exploited.
| Field | Value |
|---|---|
| CVSS 3.1 | 7.2 (HIGH) |
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD published | 2026-10-14 |
| Added to CISA KEV | 2026-10-14 |
| CISA due date | 2026-10-17 |
| Known ransomware use | no (per CISA) |
What the Flaw Does
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
CISA classifies it as code injection. The attacker must be authenticated on the management interface and able to reach it. They come out with root control of the device.
Not affected: Cloud NGFW and Prisma Access.
Why a 7.2 Still Calls for Urgency
PR:H drags the score down: an admin account is required. Three reasons not to relax.
- Firewall admin credentials leak. Reused passwords, shared accounts, credentials lifted from a compromised admin workstation. An attacker already inside often finds some.
- Flaws chain. An authentication bypass on the same interface would turn this authenticated RCE into a plain RCE. That pattern is common on exposed admin interfaces.
- Root isn't admin. A PAN-OS admin changes policy; root access lets an attacker settle beneath the OS, intercept traffic, and survive a password reset.
Above all: it's in KEV. Someone is already using it.
Versions
NVD lists these bounds for PAN-OS: 10.2.0, 10.2.7, 10.2.8, 10.2.9 and 12.2.4. They are CPE configuration bounds, not the list of fixed releases to install. Check the Palo Alto Networks security advisory for the fixed release on your branch.
For a precedent on the same product line, see CVE-2026-0300 in the PAN-OS Authentication Portal.
Detection
- Management interface logins from addresses outside your admin networks
- Admin logins at unusual hours or from rarely used accounts
- Configuration changes with no matching change ticket
- Unexpected processes, files or scheduled tasks surfaced by Palo Alto diagnostic tooling or forensic review — CISA points to its forensics triage requirements for this entry
Mitigation
- Apply the PAN-OS update Palo Alto Networks lists for your branch, before the October 17 deadline.
- Restrict the management interface to trusted internal IP addresses only, as the vendor recommends. It should never be exposed to the internet.
- Check management profiles on data interfaces: a profile allowing HTTPS or SSH on an exposed interface opens admin access.
- Audit admin accounts: remove unused ones, enforce MFA, rotate passwords.
- If in doubt: treat the device as compromised, follow the forensic triage procedure, and rotate the secrets it holds (VPN keys, certificates, service accounts).
Why Monitor Your Edge Devices
A firewall sees all the traffic. A HIGH-rated CVE that's exploited on its management interface is more urgent than a theoretical CRITICAL elsewhere.
With cveo.tech, inventory your firewalls with exact PAN-OS versions, and get alerted whenever a CISA KEV CVE affects them.