An attacker with management access and a high-privilege login can use a code-injection flaw in Palo Alto Networks PAN-OS to run code as root on a firewall. Palo Alto Networks’ advisory says, “Very limited exploitation has been observed targeting the Palo Alto Networks management interface.” Operators of affected firewalls and Panorama systems should compare installed builds with the fixed hotfixes and narrow access to their management interfaces now.
On October 14, CISA listed CVE-2026-0322 among known exploited flaws, with a federal remediation due date of October 17 and forensic triage marked Yes. The vendor lists PA-Series and VM-Series firewalls plus virtual and M-Series Panorama as affected; Cloud NGFW and Prisma Access are unaffected. An internet-reachable management port raises the risk, but the flaw needs network access and an authenticated, high-privilege account, including from inside the network.
Management access reaches root code
The vulnerable surface is the PAN-OS management interface. Palo Alto Networks classifies the bug as code injection, CWE-94; its CVE record also describes execution with root privileges. Root access on a firewall puts the system that enforces network policy in the attacker’s hands. Palo Alto Networks says no special configuration is required for the affected builds, and credits internal reporter Suraj Siddharudh with finding the issue.
The management network is the first place to look. A firewall whose admin interface is reachable from the internet presents a wider target; one reachable only from a jump box has a narrower path. Palo Alto Networks recommends allowing that jump box as the sole management-access system. This limits who can reach the vulnerable service while the software is brought up to date.
Three addresses mark reported attempts
Palo Alto Networks associates 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234 with threat activity and limited exploit attempts against this vulnerability. Search management-interface access and firewall traffic records for those source addresses, then correlate any matches with administrative login events and the installed PAN-OS build. A match merits incident triage, especially if the account had high privileges. A clean address search alone is a narrow check because the vendor’s Threat Prevention signatures cover only known patterns and other variations may pass.
The vendor says no known workaround exists. Its optional Threat Prevention coverage requires Applications and Threats content 9159-10287 or later, Threat IDs 510046 and 510047, incoming management traffic routed through a dataplane port, replacement of the inbound management certificate, SSL decryption, and Threat Prevention enabled on that inbound traffic. Direct access to the MGT port does not put that traffic through the configured dataplane inspection path. The diagram shows where those routes diverge; signature coverage remains limited even on the inspected route.
Figure details
The upper lane shows direct management traffic reaching the MGT port and then PAN-OS management. The lower lane shows management traffic routed through a dataplane port and then TLS inspection. The figure notes that Threat IDs 510046 and 510047 offer limited coverage; the inspected route requires the vendor's other listed configuration steps.
Hotfix floors differ by branch
Match each device’s installed build to the vendor’s branch-specific fix table; fixed hotfixes differ within major versions. The first fixed floors include 12.2.4 for PAN-OS 12.2; 12.1.4-h12, 12.1.7-h8 and 12.1.10-h2 for the corresponding 12.1 maintenance lines; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15 and 11.2.13-h3 for their 11.2 lines; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 and 11.1.16-h3 for 11.1; and 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 and 10.2.18-h12 for 10.2. For 11.2.14 and 11.2.15, Palo Alto Networks lists only 11.2.16 as the fixed release, with an October 15 ETA. Keep management access restricted to a trusted jump box while awaiting that release, then upgrade to 11.2.16 or later. Upgrade unsupported older PAN-OS to a supported fixed release.
Restrict access and verify builds
Inventory PA-Series, VM-Series and Panorama management endpoints and compare their specific installed PAN-OS build with the matching row of Palo Alto Networks’ fix table. Install the fixed build for that line. Restrict management access to trusted internal IPs, ideally a single jump box, and remove external exposure. Look for the vendor’s three IPs in management-access and firewall traffic records alongside privileged login events; investigate correlated activity using CISA’s requested forensic triage process.
Test the access rule from the designated jump box and from a separate, untrusted network. The expected result is management access from the jump box alone, with the installed build at or above its applicable fixed hotfix. Keep the management access test and the build check together: one reduces who can reach the service, and the other removes the vulnerable code path.