Palo Alto Networks has fixed a flaw in the management interface of its firewall and Panorama software
that lets an attacker with administrator access run any code with full control of the device. The
company has seen a small number of attacks and has no workaround. Organisations using Palo Alto
firewalls should lock down management access to trusted internal addresses and install the fixed
software versions now
1. Vulnerability Details
CVE ID- CVE-2026-0322
CVSS SCORE- 8.6 (High) CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A
EXPLOIT STATUS- Very limited exploitation observed (Exploit Maturity: ATTACKED)
CWE-94: Improper Control of Generation of Code (‘Code Injection’). An authenticated attacker with network access to the
PAN-OS management interface can run arbitrary code with root privileges on the firewall. The flaw affects PAN-OS on
PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series), with no special configuration required. Risk
is highest when the management interface is reachable from the internet; limiting access to a jump box lowers the score
to 8.5.
2. Affected Products & Fixed Versions
| COMPONENT | VULNERABLE VERSIONS | FIXED BUILD |
| PAN-OS 12.2 | < 12.2.4 | 12.2.4 |
| PAN-OS 12.1 | < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2 | 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 |
| PAN-OS 11.2 | < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13 h3, < 11.2.16 | 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13 h3, 11.2.16 (ETA 15 October) |
| PAN-OS 11.1 | < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10 h35, < 11.1.13-h15, < 11.1.16-h3 | 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10 h35, 11.1.13-h15, 11.1.16-h3 |
| PAN-OS 10.2 | < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16 h11, < 10.2.18-h12 | 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16 h11, 10.2.18-h12 |
3. Observed Activity
Cloud NGFW and Prisma Access are not affected. Older unsupported PAN-OS versions must move to a supported fixed
release.
- Exploitation status: Palo Alto Networks reports very limited exploitation targeting the management interface and has published three IP addresses linked to exploit attempts. No threat actor or post-exploitation activity has been disclosed
- Threat Prevention coverage (limited):Threat IDs 510046 and 510047 (content version 9159-10287 and later) offer limited protection, and only when management traffic is routed through a data-plane interface with SSL decryption and threat prevention enabled. Variants may evade the signatures.
4. Indicators of Compromise (IOCs)
TYPE- INDICATOR
IP- 66[.]42[.]72[.]14
IP-208[.]83[.]239[.]114
IP-149[.]248[.]47[.]234
5. Recommendations
- Identify PA-Series, VM-Series, and Panorama devices on affected PAN-OS builds, and check whether their management interface is reachable from the internet or untrusted networks.
- Restrict management interface access to trusted internal IP addresses or a single jump box now, and review recent administrator logins from unexpected sources.
- Upgrade to the fixed hotfix for your branch, such as 12.2.4, 12.1.10-h2, 11.1.16-h3, 10.2.18-h12, or 11.2.16 on release, and move unsupported versions to a supported fixed release.
- If upgrading is delayed, enable Threat IDs 510046 and 510047 with management traffic routed through a data-plane interface and SSL decryption on; coverage is limited.
- Monitor for the IOCs. Block the IOCs at their respective controls.
6. Sources
https://security.paloaltonetworks.com/CVE-2026-0322
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.