Description
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Palo Alto Networks | Cloud NGFW | — |
| Palo Alto Networks | PAN-OS | >= 12.2.0, < 12.2.4; >= 12.1.0, < 12.1.10-h2; >= 11.2.0, < 11.2.16; >= 11.1.0, < 11.1.16-h3; >= 10.2.0, < 10.2.18-h12 |
| Palo Alto Networks | Prisma Access | — |
References
- https://security.paloaltonetworks.com/CVE-2026-0322Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322US Government Resource
Timeline
- Published
- Oct 14, 2026
- Last modified
- Nov 10, 2026
- Added to CISA KEV
- Oct 14, 2026
- NVD status
- Analyzed