BREAKING: Exploited PAN-OS bug gives attackers root on Palo Alto firewalls, now on CISA KEV (CVE-2026-0322)

Someone with a working admin login and a network path to your Palo Alto firewall's management interface can run their own code on it as root. Palo Alto Networks published CVE-2026-0322 on 2026-10-14, marks the exploit maturity as Attacked, and says "very limited exploitation has been observed." CISA added it to the Known Exploited Vulnerabilities catalog the same day with a due date of 2026-10-17. It hits PAN-OS on PA-Series and VM-Series firewalls and on Panorama. If your management page answers from the internet, treat this as tonight's work.

This post is our operator read of Palo Alto's advisory and the CISA KEV entry. The HOL Guard evidence pack for CVE-2026-0322 is the source record.

How to fix

Install the hotfix for the train you already run. From the CLI:

> show system info | match sw-version
> request system software check
> request system software download version 11.2.10-h15
> request system software install version 11.2.10-h15
> request restart system

Swap in your own target from the table. Palo Alto lists no workaround, so the upgrade is the fix.

The 11.2 rows hide a gap. If you are on 11.2.14 or 11.2.15, there is no hotfix for you today. Your only listed fix is 11.2.16, which Palo Alto expects on October 15. Until it lands, the management lockdown below is the only thing between those boxes and this bug.

Patch Panorama too, and do it first. Panorama has to run the same or a newer release than the firewalls it manages, and it is in scope here (virtual and M-Series). Root on Panorama is worse than root on one firewall, because Panorama pushes config to all of them. In an HA pair, both peers need the new build.

Lock down the management page tonight

Palo Alto's own risk note is the useful part: the score drops when only a jump box can reach management, and the risk is highest when management is open to the internet. So while the upgrade window gets scheduled:

• Limit the management interface to a short list of trusted internal addresses or a single jump host (Device > Setup > Interfaces > Management > Permitted IP Addresses).
• Check every data plane interface for an Interface Management profile with HTTPS or SSH turned on. An outside interface with management enabled is a management interface on the internet, even if the dedicated MGT port is clean.
• Block and search for the three addresses Palo Alto ties to exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234.

The Threat Prevention route (Threat IDs 510046 and 510047, content 9159-10287 and later) is not a quick toggle. It only works if management traffic comes in through a data plane port, you replace the inbound management certificate, and you decrypt that traffic so the firewall can inspect it. Palo Alto calls the coverage "limited." For most shops, that is more change than the patch itself.

The login is the real precondition

The CVSS vector says privileges required: high. In plain terms, the attacker has to log in to the management interface first. That sounds reassuring until you think about how firewall admin accounts actually get handled: shared local admin passwords, the same credential on every box, accounts left behind by a former MSP. Palo Alto has not said how the observed attackers got their logins, but the bug turns any one of those leaks into root on the device that sees all your traffic.

So if a firewall had management reachable from outside your network, patching is step one, not the end. Rotate the admin passwords on it, remove local accounts nobody can explain, and look at who logged in recently. CISA's KEV entry for this CVE also flags forensic triage as required for agencies, which tells you how it expects people to treat exposed boxes.

Who is not in scope

• Cloud NGFW and Prisma Access. Palo Alto says both are not impacted and need no action.
• Anyone without valid management credentials. This is an authenticated bug; it does not let a stranger log in.
• Firewalls whose management is reachable only from a dedicated jump host. They are still affected and still need the patch, but Palo Alto scores that setup lower because an attacker has to be on that host first.

One operator check

On each firewall and Panorama, run this and compare against the table:

> show system info | match sw-version
> show admins
> configure
# show deviceconfig system permitted-ip
# show network profiles interface-management-profile

sw-version tells you which row you are in. show admins lists who is logged in right now and from which address; an address outside your admin network is a problem now, not after the patch. An empty permitted-ip list means the management port accepts any source that can route to it. Any interface management profile with HTTPS or SSH enabled on an internet-facing zone needs to go.

What this is not

This is not an internet worm and not an unauthenticated takeover: an attacker needs an admin login and a network path to management. It does not affect Cloud NGFW or Prisma Access. Palo Alto has not published technical details of the code injection, and the advisory points to no public exploit code. It is still exploited and on KEV, so a firewall with exposed management and a reused admin password is the case to fix first.

The details

• CVE: CVE-2026-0322, code injection in the PAN-OS management interface (CWE-94, CAPEC-242).
• Severity: Palo Alto rates it High, CVSS-B 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) with suggested urgency Highest. With management limited to a jump box it scores 8.5.
• Impact: arbitrary code execution as root on the firewall or Panorama.
• Affected: PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 below the fixed builds above, on PA-Series, VM-Series and Panorama. No special configuration is required to be affected.
• Exploitation: Palo Alto reports very limited exploitation targeting the management interface. On CISA KEV since 2026-10-14, federal due date 2026-10-17.
• Credit: Suraj Siddharudh, internal reporter at Palo Alto Networks.

References

• Palo Alto Networks: CVE-2026-0322 PAN-OS Authenticated Remote Code Execution (RCE) in the Management Interface
• CISA Known Exploited Vulnerabilities catalog
• NVD: CVE-2026-0322