CVE-2026-0322PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

8.6 HIGHEPSS 1.74%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-10-15 13:47 UTC

OverviewCVSS details

8.6HIGHCVSS 4.0

Score source: palo_alto (CNA)
NVD status: Analyzed
Published: Oct 14, 2026
Assigner: palo_alto

Affected

Cloud NGFW (Palo Alto Networks)

+2 more products →

Exploitation

Public exploit: None listed
CISA KEV: Listed · Oct 14, 2026
KEV due date: Oct 17, 2026
Ransomware use: Unknown
SSVC: Exploitation active · Automatable no · Impact total

EPSS · FIRST, scored Nov 7

1.74%chance of exploitation in 30 days

Higher than 77.86% of CVEs

CVSS 4.0 · palo_alto (CNA)

8.6High

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 4.0 · palo_alto (CNA)

8.5High

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red

Attack vector: Adjacent
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

7.2High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
8.6	HIGH	4.0palo_alto (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red
8.5	HIGH	4.0palo_alto (CNA)	CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red
7.2	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Oct 17, 2026

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Details

CVE ID: CVE-2026-0322
Status: Analyzed
Assigner (CNA): palo_alto
Published: Oct 14, 2026
Last modified: 2026-10-15 13:47 UTC
Weaknesses: CWE-94 · Improper Control of Generation of Code ('Code Injection')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:04 UTC.