Palo Alto Networks PAN-OS Flaw Lets Attackers Run Code as Root

Palo Alto Networks says “Very limited exploitation has been observed” against the PAN-OS management interface in CVE-2026-0322. An attacker needs network access and a high-privilege login; code injection then permits root-level code execution on the firewall. CISA added the flaw to its exploited-vulnerabilities catalog on October 14, with an October 17 federal remediation due date and forensic triage marked Yes. PA-Series and VM-Series firewalls and Panorama are in scope. Cloud NGFW and Prisma Access are unaffected.

Compare the specific installed build with the vendor’s maintenance-line hotfix table, then install the appropriate fixed version. For example, the fix for PAN-OS 12.2 starts at 12.2.4; fixes for 12.1, 11.2, 11.1 and 10.2 differ by maintenance line. Restrict management access to trusted internal IPs, ideally a single jump box, and remove internet exposure. Palo Alto Networks lists 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234 as associated with threat activity and limited attempts; correlate any management or traffic-log hits with privileged login events.

Threat IDs 510046 and 510047 offer limited coverage when management traffic traverses a configured dataplane port with SSL decryption and Threat Prevention enabled. Direct MGT access bypasses that inspection route. Verify the installed hotfix and test that the designated jump box reaches management while an untrusted network cannot.