Authenticated code injection in PAN-OS management interface gives root on the firewall (CVE-2026-0322)
Palo Alto Networks confirmed attacks and CISA added the flaw to KEV on 2026-10-14 with a 2026-10-17 remediation deadline, and a team that leaves a reachable management interface on an unfixed build risks an attacker with any valid admin session gaining persistent root on the firewall.
A code injection flaw in the PAN-OS management interface lets an authenticated attacker with network access to that interface execute arbitrary code as root on PA-Series and VM-Series firewalls and on Panorama. Palo Alto Networks rates the urgency HIGHEST and reports limited exploitation against customer firewalls; Cloud NGFW and Prisma Access are not affected.
Affected: PAN-OS 12.2 < 12.2.4; PAN-OS 12.1 < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2; PAN-OS 11.2 < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16; PAN-OS 11.1 < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3; PAN-OS 10.2 < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12; PA-Series and VM-Series firewalls and Panorama (virtual and M-Series); Cloud NGFW and Prisma Access not impacted
How to Test
Compare the running PAN-OS version on every firewall and Panorama against the fixed hotfix builds for your release train (e.g. 12.2.4, 12.1.4-h12, 11.2.16, 11.1.16-h3, 10.2.18-h12 and the other listed hotfixes). Determine whether the management interface is reachable from the internet or from untrusted networks. Palo Alto Networks has published indicators of compromise alongside the advisory; check management-interface and administrative login logs against them and treat any administrative session from an unexpected source address or any unexplained configuration or system changes as grounds for incident response.
How to Patch
Upgrade to PAN-OS 12.2.4, 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2, 11.2.4-h22 / 11.2.7-h21 / 11.2.10-h15 / 11.2.13-h3 / 11.2.16, 11.1.4-h37 / 11.1.6-h39 / 11.1.7-h11 / 11.1.10-h35 / 11.1.13-h15 / 11.1.16-h3, or 10.2.7-h38 / 10.2.10-h41 / 10.2.13-h26 / 10.2.16-h11 / 10.2.18-h12 or later as applicable. Until upgraded, restrict management-interface access to trusted internal IP addresses per Palo Alto Networks' best-practice deployment guidelines.