# Palo Alto Networks PAN-OS Management Interface RCE (CVE-2026-0322) Exploited in Attacks

> CVE-2026-0322 is an authenticated remote code execution flaw (CWE-94 code injection) in the PAN-OS management interface that lets an attacker with valid credentials and network access execute code as root. Palo Alto Networks reports very limited exploitation, and CISA added the flaw to the KEV catalog on 2026-10-14 with a 2026-10-17 federal due date.

- **Published:** 2026-10-14T23:10:26Z
- **Last reviewed:** 2026-10-15T15:07:48.678Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3562
- **ID:** TL-2026-3562
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-0322

## Description

CVE-2026-0322 is a remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS. Per the vendor advisory and NVD, an authenticated attacker with network access to the management interface can execute arbitrary code with root privileges on the firewall. The weakness is classified as CWE-94 (Improper Control of Generation of Code / Code Injection, CAPEC-242). The vendor scores it 8.6 HIGH under CVSS 4.0 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, with exploit maturity set to Attacked), reflecting that high privileges (valid management credentials) are required but impact on the device is complete.

Affected products are PA-Series and VM-Series firewalls and Panorama (virtual and M-Series appliances) running PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2. Cloud NGFW and Prisma Access are not affected. The flaw was found internally by Suraj Siddharudh of Palo Alto Networks product security. The vendor states that very limited exploitation has been observed targeting the management interface, and lists three source IP addresses tied to the exploit attempts: 66.42.72.14, 208.83.239.114 and 149.248.47.234. No threat actor, campaign, or post-exploitation tooling has been publicly attributed in the sources reviewed.

There are no known workarounds. The vendor guidance is to restrict management interface access to trusted internal IP addresses and to upgrade to a fixed release. Fixed releases include 12.2.4, 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2, with additional fixed builds for 10.2, 11.1 and 11.2; a PAN-OS 11.2.16 fix was expected on 2026-10-15. Customers on unsupported versions must move to a supported release. Threat Prevention subscribers get limited coverage through Threat IDs 510046 and 510047, which requires SSL decryption and management traffic routed through data plane ports. CISA added the CVE to the KEV catalog on 2026-10-14 with an action due date of 2026-10-17.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1133 External Remote Services
- T1068 Exploitation for Privilege Escalation

## Sources

- [Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/)
- [Palo Alto Networks Security Advisory CVE-2026-0322](https://security.paloaltonetworks.com/CVE-2026-0322)
- [NVD - CVE-2026-0322](https://nvd.nist.gov/vuln/detail/CVE-2026-0322)
- [NVD CVE API record for CVE-2026-0322](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-0322)
- [CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-0322](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3562