Active Exploitation of Palo Alto PAN-OS Remote Code Execution Vulnerability (CVE-2026-0322)

Palo Alto Networks has released security updates addressing CVE-2026-0322, a high-severity authenticated remote code execution (RCE) vulnerability affecting the management interface of PAN-OS. The vendor has confirmed that the vulnerability is being actively exploited in the wild, with observed exploitation attempts targeting exposed management interfaces.

Successful exploitation allows an authenticated attacker with network access to the management interface to execute arbitrary code with root privileges, potentially resulting in complete compromise of the firewall or Panorama management platform.

The vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalogue, highlighting the elevated risk and requiring prioritised remediation by U.S. federal agencies.

Vulnerability Details

According to Palo Alto Networks, the flaw resides within the PAN-OS management interface and enables authenticated attackers with network access to execute arbitrary commands as the root user.

Fixed Versions

Upgrade to the following PAN-OS releases or later:

• PAN-OS 12.2.4+
• PAN-OS 12.1.4-h12+, 12.1.7-h8+, 12.1.10-h2+
• PAN-OS 11.2.4-h22+, 11.2.7-h21+, 11.2.10-h15+, 11.2.13-h3+, 11.2.16+
• PAN-OS 11.1.4-h37+, 11.1.6-h39+, 11.1.7-h11+, 11.1.10-h35+, 11.1.13-h15+, 11.1.16-h3+
• PAN-OS 10.2.7-h38+, 10.2.10-h41+, 10.2.13-h26+, 10.2.16-h11+, 10.2.18-h12+

Affected Products

The following products are impacted:

• PA-Series Firewalls
• VM-Series Firewalls
• Panorama Virtual Appliances
• Panorama M-Series Appliances

The following services are not affected:

• Cloud NGFW
• Prisma Access

Observed Indicators of Compromise

Palo Alto Networks has identified the following IP addresses as being linked to observed exploitation attempts:

Note: These indicators should be treated as investigative leads only. Blocking these IPs alone will not mitigate the vulnerability.

Recommended Actions

1. Patch affected devices immediately to a fixed PAN-OS release.
2. Review all internet-facing management interfaces.
3. Restrict administrative access to trusted internal management networks only.
4. Disable direct internet exposure of the management interface.
5. Investigate authentication logs for suspicious administrator activity.

Palo Alto Networks specifically recommends:

• Restricting access to the management interface to trusted internal IP addresses.
• Using a dedicated jump host that serves as the sole management access point.

Additional best practices:

• Enforce MFA for all administrative accounts.
• Implement privileged access management (PAM).
• Segregate management traffic from production networks.
• Enable comprehensive audit logging and SIEM ingestion.
• Monitor for new or modified administrator accounts.

 If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively get in touch to find out how you can protect your organisation.