Palo Alto PAN-OS Remote Code Execution (CVE-2026-0322) Lands in the CISA Known Exploited Catalog

An authenticated flaw in PAN-OS's administration plane gives a network-attacker who can reach the console a path to root on the firewall, and CISA's KEV listing makes patching a hard deadline for federal systems.

Palo Alto Networks has disclosed a remote code execution vulnerability in PAN-OS, its firewall operating system, that an attacker who already holds valid administrative credentials can exploit to execute arbitrary code with root privileges. The flaw, tracked as CVE-2026-0322 and classified as a code injection defect (CWE-94), was published on 14 October 2026 and is already listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, with a federal remediation deadline of 17 October 2026.

What makes the disclosure matter is the combination of reach and privilege. The vulnerability sits in the management interface of PAN-OS. Anyone with network access to that administration plane, together with a valid authenticated account, can push a crafted payload that runs with root on the firewall. The NVD scores it at 8.6 under CVSS 4.0 and 7.2 under CVSS 3.1, both in the High range, while Palo Alto's own advisory marks it High with the highest urgency tier and a maturity level indicating active exploitation rather than theoretical risk.

How the flaw works

The core weakness is a classic injection: the management console trusts attacker-controlled input on a code path where it can change what code the firewall executes. Because the administrative plane typically runs with elevated rights, a single successful injection bypasses normal memory-corruption limits and lands the attacker directly at root. There is no disclosure that an unauthenticated or zero-click path is required; the prerequisite is a compromised or legitimately issued administrator account on, or jump-box access to, a reachable management interface.

That prerequisite is exactly what makes the threat realistic in the wild. Firewall admin credentials are frequently weak, reused, or exposed through brute force, phishing, or stolen internal access. A threat actor who has already been inside an environment, or who can reach an internet-facing management port, can weaponize this flaw to plant a persistent, root-level foothold on the very appliance that is supposed to guard everything else.

What is affected

Palo Alto's advisory scopes the issue to PAN-OS software on its physical, virtual, and Panorama platforms. The affected families include PA-Series physical appliances, VM-Series virtual firewalls, and Panorama (both virtual and M-Series) central-management systems. The fixes are spread across a large matrix of 10.2, 11.1, 11.2, 12.1, and 12.2 versions, with multiple hotfix levels per branch, so administrators must map their running version to the specific corrected revision rather than assume a single update covers them.

Not affected: Cloud NGFW and Prisma Access are not impacted, so those subscribers do not need an emergency patch for this CVE.
Scope: PA-Series, VM-Series, and Panorama (virtual and M-Series) running the affected 10.2/11.1/11.2/12.1/12.2 pan-OS releases.
Risk driver: any deployment exposing the management interface beyond trusted internal IP ranges materially widens the exposure window.

Why CISA flagged it

CISA added the vulnerability to the KEV catalog on the same day it was disclosed, which in the US federal landscape converts remediation from best practice into a hard deadline under existing binding operational directives. The catalog entry records the 17 October due date and calls for forensic triage, meaning agencies are expected to assume compromise and hunt for evidence of exploitation, not merely patch. The fact that it reached the catalog on disclosure day, paired with Palo Alto's active-exploitation maturity rating, signals that tooling is already in the hands of attackers.

Palo Alto notes there is no equivalent public workaround short of restricting access to the management interface. Its recommended best practice is to limit administration to trusted internal IP addresses, or to front the console with a dedicated jump box that is the sole system allowed to reach it. The advisory itself describes the issue as minimized when the management plane is not reachable from untrusted networks, which points to the practical defense: reduce the surface, then patch.

What this means for you

If you run PAN-OS, treat this as an active-incident item, not a quarterly update. Cross-reference your exact version against the Palo Alto advisory matrix, identify whether your management interface is reachable more broadly than it should be, and if you are a federal agency hold to the 17 October deadline and complete forensic triage. Assume a compromised admin account can become a root compromise of the firewall itself.

Sources: Palo Alto Networks security advisory, PAN-OS Authenticated Remote Code Execution in the Management Interface (CVE-2026-0322); NIST National Vulnerability Database, CVE-2026-0322.

Corrections: Report an error at corrections@wireshaman.com.