---
title: "PAN-OS CVE-2026-0322: Exploited Management-Interface RCE"
url: https://erroneo.us/security/briefs/pan-os-cve-2026-0322-management-interface-rce/
description: "Authenticated root RCE in the PAN-OS management interface, exploited and in CISA KEV. Fixed in 12.2.4, 11.2.16 and hotfixes. Patch, and lock down mgmt access."
type: security-brief
section: "Security Digest"
date_published: 2026-10-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-0322"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# PAN-OS CVE-2026-0322: Exploited Management-Interface RCE

**Verdict: Patch this week.** Patch every PAN-OS firewall and Panorama this week, and today if the management interface is reachable from the internet; the bug needs an admin login but is already being exploited.

- **Who must act:** Anyone running PAN-OS 10.2 through 12.2 on PA-Series or VM-Series firewalls or on Panorama, most urgently where the management web interface is exposed beyond a trusted admin network.
- **Who can relax:** Cloud NGFW and Prisma Access customers (not affected), and teams whose management interface is reachable only from a locked-down jump host can patch on a normal but prompt cycle.
- **Affected:** PAN-OS 12.2 before 12.2.4; PAN-OS 12.1 before 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2; PAN-OS 11.2 before 11.2.4-h22 / 11.2.7-h21 / 11.2.10-h15 / 11.2.13-h3 / 11.2.16; PAN-OS 11.1 before 11.1.4-h37 / 11.1.6-h39 / 11.1.7-h11 / 11.1.10-h35 / 11.1.13-h15 / 11.1.16-h3; PAN-OS 10.2 before 10.2.7-h38 / 10.2.10-h41 / 10.2.13-h26 / 10.2.16-h11 / 10.2.18-h12; Panorama (virtual and M-Series) on the same PAN-OS versions
- **Fixed:** PAN-OS 12.2.4; PAN-OS 12.1.10-h2 (or 12.1.7-h8, 12.1.4-h12); PAN-OS 11.2.16 (or the 11.2 hotfixes listed by the vendor); PAN-OS 11.1.16-h3 (or the 11.1 hotfixes listed by the vendor); PAN-OS 10.2.18-h12 (or the 10.2 hotfixes listed by the vendor)
- **CVEs:** CVE-2026-0322
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every PA-Series, VM-Series and Panorama instance and its PAN-OS version (show system info).
2. Upgrade to the fixed release or hotfix for your train from the vendor table, starting with any device whose management interface is internet-reachable.
3. Restrict the management interface to trusted internal addresses or a single jump host; remove any internet exposure.
4. Review admin accounts and rotate administrator passwords and API keys, since exploitation requires valid admin credentials.
5. If you cannot upgrade immediately and have Threat Prevention, enable Threat IDs 510046 and 510047 with the vendor's management-traffic prerequisites (limited coverage only).

### How to check if you are affected

- Search firewall and network logs for management-interface connections from 66.42.72.14, 208.83.239.114 and 149.248.47.234, which Palo Alto Networks ties to exploit attempts.
- Review admin login and configuration audit logs for unfamiliar sources, new administrators or unexpected commits.
- Check whether the management interface was reachable from the internet at any point since mid-October 2026; if so, treat compromise as possible and hunt accordingly.

## What happened

On October 14, 2026, Palo Alto Networks published [CVE-2026-0322](https://security.paloaltonetworks.com/CVE-2026-0322), a code injection flaw (CWE-94) in the PAN-OS management web interface. An attacker who can reach that interface and holds administrator credentials can run arbitrary code as root on the firewall. The vendor found the bug internally. Its advisory states that "very limited exploitation has been observed" and lists three IP addresses linked to exploit attempts. CISA added the CVE to the [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322) the same day, with a federal remediation deadline of October 17.

The vendor scores it CVSS 4.0 8.6 (High) when the interface is internet-reachable and 8.5 when it is limited to an adjacent network. It sets its suggested urgency to "highest". [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-0322) rates it CVSS 3.1 7.2. The required privilege level, high, is what keeps the score below critical.

## Who is affected

PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series) are affected. The vendor says no special configuration is needed to be vulnerable. Cloud NGFW and Prisma Access are not affected. Fixed builds are 12.2.4 and 11.2.16, plus hotfixes on every supported train, for example 12.1.10-h2, 11.1.16-h3 and 10.2.18-h12. Older maintenance lines get their own hotfixes, such as 11.2.7-h21 and 10.2.13-h26. The full table is on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-0322) and the advisory.

## Do you really need to act?

Yes, but the urgency depends on two things: who can reach the management interface, and how well admin credentials are protected. An authenticated bug sounds tame. In practice, firewall admin credentials leak through phishing, reuse, old config backups and earlier appliance compromises. Root on a firewall gives an attacker a quiet foothold at the edge of your network, with visibility into traffic and VPN configuration.

- **Management interface on the internet:** treat this as act-now. Palo Alto Networks says the risk is highest in this setup and recommends remediating as soon as possible.
- **Management limited to a jump host or admin VLAN:** the attacker first needs a foothold there plus admin credentials. Patch this week.
- **Cloud NGFW / Prisma Access:** no action needed.

The vendor lists no workaround. Threat Prevention customers can enable Threat IDs 510046 and 510047, but the vendor describes this as limited coverage. It also requires routing management traffic through a dataplane interface with SSL decryption, so it is not a practical substitute for upgrading.

## What to do now

1. Inventory devices and versions. On each firewall or Panorama, run `show system info` and note `sw-version`.
2. Upgrade to the fixed build for your train (for example `request system software install version 11.2.16` after download), starting with internet-exposed devices. Upgrade Panorama too.
3. Lock the management interface down to trusted internal IPs, following the vendor's [management access best practices](https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431). Remove any permit rule that exposes it to the internet, including management profiles on public dataplane interfaces.
4. Rotate administrator passwords and API keys, enforce MFA for admin login, and remove stale admin accounts.
5. If an upgrade has to wait, enable Threat IDs 510046/510047 with the documented prerequisites, and tighten access controls in the meantime.

## How to tell if you were hit

Search perimeter and firewall traffic logs for management-plane connections from `66.42.72.14`, `208.83.239.114` and `149.248.47.234`, the addresses Palo Alto Networks associates with exploit attempts. Review the system and configuration logs for admin logins from unfamiliar sources, newly created administrators and unexplained commits. If the interface was reachable from the internet while unpatched, treat the device as possibly compromised. Open a case with Palo Alto Networks support, export logs before rebooting, and rotate every credential stored on the device, including VPN, LDAP and RADIUS secrets. A root-level implant may not show up in configuration logs.

## Timeline

- Oct 14, 2026 — Palo Alto Networks publishes the advisory with fixed builds and notes limited exploitation. CISA adds CVE-2026-0322 to KEV the same day.
- Oct 15, 2026 — The advisory is updated, and the CVE record gets CISA's enrichment (exploitation: active).
- Oct 17, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [Palo Alto Networks — CVE-2026-0322 PAN-OS: Authenticated RCE in the Management Interface](https://security.paloaltonetworks.com/CVE-2026-0322)
2. [CVE record — CVE-2026-0322](https://www.cve.org/CVERecord?id=CVE-2026-0322)
3. [NVD — CVE-2026-0322](https://nvd.nist.gov/vuln/detail/CVE-2026-0322)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-0322](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322)
5. [Palo Alto Networks — How to secure the management access of your Palo Alto Networks device](https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431)

---
Source page: https://erroneo.us/security/briefs/pan-os-cve-2026-0322-management-interface-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt