Threat reportVulnerabilityTL-2026-3562
Palo Alto Networks PAN-OS Management Interface RCE (CVE-2026-0322) Exploited in Attacks
Palo Alto Networks PAN-OS Management Interface RCE (TL-2026-3562) is a high-severity software vulnerability scored CVSS 8.6, first published 2026-10-14 and last reviewed 2026-10-15. It has no confirmed attribution, affects Palo Alto Networks PAN-OS (PA-Series, VM-Series firewalls), references 1 CVE (CVE-2026-0322), maps to 5 MITRE ATT&CK techniques (T1059, T1068, T1078), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 8.6/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3562
- Threat ID
- TL-2026-3562
- Severity
- HIGH
- CVSS
- 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, telecoms, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
- Updates
- 2026-10-15 · 2 updates · revalidated 2× · latest source
How Palo Alto Networks PAN-OS Management Interface RCE works
CVE-2026-0322 is an authenticated remote code execution flaw (CWE-94 code injection) in the PAN-OS management interface that lets an attacker with valid credentials and network access execute code as root. Palo Alto Networks reports very limited exploitation, and CISA added the flaw to the KEV catalog on 2026-10-14 with a 2026-10-17 federal due date.
CVE-2026-0322 is a remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS. Per the vendor advisory and NVD, an authenticated attacker with network access to the management interface can execute arbitrary code with root privileges on the firewall. The weakness is classified as CWE-94 (Improper Control of Generation of Code / Code Injection, CAPEC-242). The vendor scores it 8.6 HIGH under CVSS 4.0 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, with exploit maturity set to Attacked), reflecting that high privileges (valid management credentials) are required but impact on the device is complete.
Affected products are PA-Series and VM-Series firewalls and Panorama (virtual and M-Series appliances) running PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2. Cloud NGFW and Prisma Access are not affected. The flaw was found internally by Suraj Siddharudh of Palo Alto Networks product security. The vendor states that very limited exploitation has been observed targeting the management interface, and lists three source IP addresses tied to the exploit attempts: 66.42.72.14, 208.83.239.114 and 149.248.47.234. No threat actor, campaign, or post-exploitation tooling has been publicly attributed in the sources reviewed.
There are no known workarounds. The vendor guidance is to restrict management interface access to trusted internal IP addresses and to upgrade to a fixed release. Fixed releases include 12.2.4, 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2, with additional fixed builds for 10.2, 11.1 and 11.2; a PAN-OS 11.2.16 fix was expected on 2026-10-15. Customers on unsupported versions must move to a supported release. Threat Prevention subscribers get limited coverage through Threat IDs 510046 and 510047, which requires SSL decryption and management traffic routed through data plane ports. CISA added the CVE to the KEV catalog on 2026-10-14 with an action due date of 2026-10-17.
MITRE ATT&CK techniques used in TL-2026-3562
Execution
T1059 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Defense Evasion
Affected products and versions in Palo Alto Networks PAN-OS Management Interface RCE
- Palo Alto Networks — PAN-OS (PA-Series, VM-Series firewalls)
Vulnerable versions: 10.2 (versions below fixed builds); 11.1 (versions below fixed builds); 11.2 (versions below fixed builds); 12.1 < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2; 12.2 < 12.2.4
Fixed in: 12.2.4; 12.1.4-h12; 12.1.7-h8; 12.1.10-h2; 11.2.16 (expected 2026-10-15) - Palo Alto Networks — Panorama (virtual and M-Series appliances)
Vulnerable versions: PAN-OS 10.2, 11.1, 11.2, 12.1, 12.2 (versions below fixed builds)
Fixed in: Fixed PAN-OS releases per vendor advisory
Remediation for Palo Alto Networks PAN-OS Management Interface RCE
Patches
- Upgrade to a fixed PAN-OS release per the vendor advisory (for example 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2; PAN-OS 11.2.16 expected 2026-10-15)
- Customers on unsupported versions must upgrade to a supported release
Immediate actions
- Restrict PAN-OS management interface access to trusted internal IP addresses only
- Block and hunt for management interface connections from 66.42.72.14, 208.83.239.114 and 149.248.47.234
- Review management interface and authentication logs for unexpected logins and commands, and rotate admin credentials
- Meet the CISA KEV due date of 2026-10-17 for federal civilian agencies
Workarounds
- No known workarounds exist
- Threat Prevention Threat IDs 510046 and 510047 give limited coverage, requiring SSL decryption and management traffic routed through data plane ports
Longer-term hardening
- Never expose the management interface to the internet; place it on a dedicated out-of-band management network
- Enforce MFA and least-privilege administrator roles on firewall and Panorama management accounts
CVEs associated with Palo Alto Networks PAN-OS Management Interface RCE
Weaknesses (CWE) in Palo Alto Networks PAN-OS Management Interface RCE
Timeline of Palo Alto Networks PAN-OS Management Interface RCE
- BleepingComputer reports the exploitation and lists attacker IPs 66.42.72.14, 208.83.239.114 and 149.248.47.234
- CISA adds CVE-2026-0322 to the Known Exploited Vulnerabilities catalog with an action due date of 2026-10-17
- NVD publishes CVE-2026-0322 (CVSS 4.0 score 8.6 HIGH, CWE-94) at 18:17 UTC
- Palo Alto Networks publishes advisory for CVE-2026-0322, an authenticated PAN-OS management interface RCE discovered internally by Suraj Siddharudh, and reports very limited exploitation in the wild
- NVD record modified. It carries a primary CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) alongside the vendor CVSS 4.0 score of 8.6, and the KEV required action references CISA BOD 26-04.
- SecurityWeek reports Palo Alto Networks released PAN-OS fixes on 2026-10-15 for all supported branches (12.2.4; 12.1.4-h12/7-h8/10-h2; 11.2.4-h22 through 11.2.16; 11.1.4-h37 through 11.1.16-h3; 10.2.7-h38 through 10.2.18-h12), alongside 12 other medium/low severity Palo Alto advisories.
- Cyber Security News reports active exploitation of the PAN-OS 0-day for root code execution on firewalls.
- Palo Alto Networks expects to release the PAN-OS 11.2.16 fix for CVE-2026-0322
- CISA KEV deadline for federal civilian agencies to apply mitigations for CVE-2026-0322
Update history for TL-2026-3562
- 2026-10-15 — Palo Alto PAN-OS Management Interface Code Injection Zero-Day (CVE-2026-0322) Actively Exploited: What changed No severity, exploitability or status change; the record is already HIGH / ACTIVE with CVSS 4.0 8.6. The update refines remediation data. Palo Alto fixes shipped on 2026-10-15 for every supported branch, and the per-release hot
- 2026-10-15 — Palo Alto PAN-OS 0-day (CVE-2026-0322) Management Interface Code Injection Enables Root RCE on Firewalls: What changed No field escalation. Severity HIGH, exploitability ACTIVE, status ACTIVE and CVSS 8.6 are already current. The report adds detail only: full fixed-build list (11.1.16-h3, 10.2.18-h12, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.1
Sources cited for Palo Alto Networks PAN-OS Management Interface RCE
Detection coverage for TL-2026-3562
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3562 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.