CVE-2026-0322 HIGH

CVE-2026-0322: PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

Vendor Palo Alto Networks
Product PAN-OS
Weakness CWE-94 · Code injection
KEV Status Known Exploited
Published October 14, 2026
Last update October 15, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red

What the vulnerability does

01Description

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

CISA mandated remediation

02CISA Required Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Key dates

03Disclosure timeline

October 14, 2026 CVE published
October 15, 2026 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-0322 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html AskarLabs — CWE-94 write-up Code Injection CISA KEV Reference https://security.paloaltonetworks.com/CVE-2026-0322 CISA KEV Reference https://www.cisa.gov/news-events/directives/bod-26-04-prioriti… CISA KEV Reference https://www.cisa.gov/news-events/directives/bod-26-04-implemen… CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2026-0322

Related vulnerabilities

05Related CVE

CVE-2026-1509 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution CVE-2026-67364 Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 CVE-2026-13353 WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter CVE-2026-73343 WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability CVE-2026-32414 WordPress Advanced Woo Labels plugin <= 2.36 - Remote Code Execution (RCE) vulnerability