cyber.hendryadrian.com
Vulnerability & Exploit · socprime.com

Actively Exploited PAN-OS Flaw Enables Root Access; Patches Released

· Original article ↗

Summary

Palo Alto Networks says CVE-2026-0322 is being exploited against PAN-OS management interfaces. The authenticated code-injection flaw can grant root access; affected organizations should upgrade and restrict management access.

Key points

  • The flaw affects PAN-OS management interfaces on supported PA-Series and VM-Series firewalls and Panorama appliances; Cloud NGFW and Prisma Access are not affected.
  • Exploitation requires valid credentials, network access to the management interface, and high privileges; successful exploitation enables arbitrary code execution as root.
  • Palo Alto Networks reported very limited exploitation but has not disclosed the attackers, targets, or observed post-exploitation activity.
  • CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog, with a federal agency remediation deadline of October 17, 2026.
  • Upgrade affected systems to the applicable fixed release. The vendor says there is no known complete workaround.
  • Restrict management access to trusted internal addresses or a designated jump box; review authentication, configuration changes, processes, and network activity for signs of compromise.
  • Palo Alto Networks published three IP indicators: 66.42.72[.]14, 208.83.239[.]114, and 149.248.47[.]234.

Article Details

Vulnerability Types
  • Code injection
Severity
High; CVSS 4.0 score 8.6
Affected Versions
  • PAN-OS 10.2
  • PAN-OS 11.1
  • PAN-OS 11.2
  • PAN-OS 12.1
  • PAN-OS 12.2
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Restrict management-interface access to trusted internal IP addresses and, where possible, allow access only from a dedicated jump box.
  • Threat Prevention subscription customers can use limited protection with Threat IDs 510046 and 510047, subject to the vendor's stated requirements; this is not a substitute for upgrading.

Indicators of compromise

TypeIndicatorContext
IPV4149[.]248[.]47[.]234IP address Palo Alto Networks associated with observed threat activity and limited exploit attempts.
IPV4208[.]83[.]239[.]114IP address Palo Alto Networks associated with observed threat activity and limited exploit attempts.
IPV466[.]42[.]72[.]14IP address Palo Alto Networks associated with observed threat activity and limited exploit attempts.

MITRE ATT&CK

T1078 · Valid AccountsExploitation requires valid credentials for an authenticated management user.T1190 · Exploit Public-Facing ApplicationAttackers exploited a vulnerability in the PAN-OS management interface to execute code on exposed appliances.

CVE

CVE-2026-0322Palo Alto Networks has released security updates addressing CVE-2026-0322, a high-severity remote code execution vulnerability affecting the management interface of PAN-OS.

People

Suraj SiddharudhSenior principal product security researcher credited by Palo Alto Networks with identifying and reporting the vulnerability.

Vendors

Palo Alto NetworksPalo Alto Networks has released security updates addressing CVE-2026-0322, a high-severity remote code execution vulnerability affecting the management interface of PAN-OS.

Products

Cloud NGFWCloud NGFW and Prisma Access are not affected.PA-SeriesThe vulnerability impacts PA-Series and VM-Series firewalls as well as Panorama virtual and M-Series appliances.PAN-OSPalo Alto Networks has released security updates addressing CVE-2026-0322, a high-severity remote code execution vulnerability affecting the management interface of PAN-OS.PanoramaThe vulnerability impacts PA-Series and VM-Series firewalls as well as Panorama virtual and M-Series appliances.Prisma AccessCloud NGFW and Prisma Access are not affected.VM-SeriesThe vulnerability impacts PA-Series and VM-Series firewalls as well as Panorama virtual and M-Series appliances.

Related Articles