CVE-2026-0322

Palo Alto Networks PAN-OS: Code Injection

As of , CVE-2026-0322 in Palo Alto Networks PAN-OS is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch now.

Exploited
Yes: CISA listed it on 14 October 2026
US federal deadline
17 October 20263 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
Forensic triage
Required by CISA under BOD 26-04Agencies must also look for signs that attackers already got in.
EPSS when listed
No score that dayThe EPSS file of the day CISA listed it has no score for it.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
Vendor advice: security.paloaltonetworks.comLinks below, from CISA's entry.

What CISA says to do

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA's required action

What the flaw is

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

CISA's description

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

The CVE record's description, from palo_alto

CVE published
14 October 2026
Assigned by
palo_alto
CVSS
8.6 High (CVSS 4.0, from the CNA)
CWE-94
Improper Control of Generation of Code ('Code Injection')
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

PAN-OS: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2026-0257Authentication BypassPalo Alto Networks PAN-OSPatch nowRansomware use, listed within a year0.97
CVE-2017-15944Remote Code ExecutionPalo Alto Networks PAN-OSPatch this weekMetasploit module; EPSS 0.98; verified Exploit-DB entry0.98
CVE-2024-0012Management Interface Authentication BypassPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
CVE-2024-9474Management Interface OS Command InjectionPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.950.95
CVE-2024-3400Command InjectionPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
CVE-2025-0108Authentication BypassPalo Alto Networks PAN-OSPatch this weekEPSS 0.980.98
CVE-2019-1579Remote Code ExecutionPalo Alto Networks PAN-OSPatch this weekRansomware use0.46
CVE-2020-2021Authentication BypassPalo Alto Networks PAN-OSPatch this weekRansomware use0.04
CVE-2026-0300Out-of-bounds WritePalo Alto Networks PAN-OSPatch soon0.32
CVE-2024-3393Malicious DNS PacketPalo Alto Networks PAN-OSPatch soon0.29

All 13 entries for PAN-OS

Read further