Palo Alto Networks PAN-OS Management Interface Remote Code Execution (RCE) Vulnerability (CVE-2026-0322)

Affected Vendors

Palo Alto Networks

Affected Components

PAN-OS, Panorama, PA-Series, VM-Series

Published Date

2026-10-14

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Management interfaces of PA-Series, VM-Series firewalls, and Panorama (Virtual and M-Series) running PAN-OS

Impact

An authenticated attacker with network access can execute arbitrary code with root privileges, leading to full system compromise

Mitigation

Apply the latest security patches immediately and restrict management interface access to trusted internal IP addresses only

Affected Products & Version Scope

Applicable to PAN-OS on PA-Series, VM-Series, and Panorama (M-Series/Virtual). Cloud NGFW and Prisma Access are confirmed as not impacted by this specific issue.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Update Firmware: Upgrade to the latest patched version of PAN-OS via the Palo Alto Networks Customer Support Portal immediately.
Network Segmentation: Ensure the management interface (MGT port) is not reachable from the public internet. Use a dedicated Out-of-Band (OOB) management network.
Restrict Permitted IPs: Configure Access Control Lists (ACLs) to limit management access to specific administrative subnets.

bash

# Restrict management access to specific subnets via CLI
set deviceconfig system permitted-ip <trusted_admin_subnet>
commit

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Prioritize patching for all management interfaces and verify that strict IP-based access control lists (ACLs) are enforced to prevent unauthorized access.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

This vulnerability (CWE-94) stems from improper input validation within the PAN-OS management web interface, leading to Code Injection. Although it requires high privileges (PR:H) for authentication, its inclusion in the CISA KEV catalog and an EPSS score of 0.94 indicate significant active exploitation. Successful exploitation grants root-level access, allowing attackers to bypass security controls, establish persistence, and use the compromised firewall as a pivot point for lateral movement within the internal network.

Official Vendor Advisories & References

NVD Original English Description

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

https://security.paloaltonetworks.com/CVE-2026-0322

Source: psirt@paloaltonetworks.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: