Threat Prevention Signatures and CVE-2026-0322: What limited Coverage Requires

Palo Alto Networks provides Threat Prevention coverage for CVE-2026-0322 through Threat IDs 510046 and 510047, available from Applications and Threats content version 9159-10287 and later. The vendor describes that coverage as limited and attaches four conditions. Read as a deployment checklist, those conditions are demanding.

The vulnerability

CVE-2026-0322 is an authenticated remote code execution flaw in the PAN-OS management interface, CWE-94, CVSS-B 8.6, granting root code execution on PAN-OS on PA-Series and VM-Series firewalls and on Panorama, virtual and M-Series. Cloud NGFW is unaffected and Prisma Access is not impacted. Exploit maturity is ATTACKED, with very limited exploitation observed targeting the management interface, and no special configuration is required for a device to be affected.

The four conditions

First, incoming traffic for the management port must be routed through a data-plane port, for example by enabling a management profile on a data-plane interface for management access. Second, the certificate for inbound traffic management must be replaced. Third, inbound traffic to the management interface must be decrypted so the firewall can inspect it. Fourth, threat prevention must be enabled on that inbound traffic to management services. The signature requires SSL decryption, so the third condition is not optional.
Each condition is a configuration change with its own risk profile. Routing management traffic through a data plane changes the traffic path for a privileged interface. Decrypting inbound management traffic introduces certificate and key handling decisions. Replacing the inbound traffic management certificate affects every administrator who connects. Together they amount to a project rather than a checkbox.

Why the vendor calls it limited

The vendor's own framing is that these signatures provide limited coverage: known attack patterns can be identified with the current Threat ID, but variations may exist that cannot currently be detected. That is a statement about signature-based detection in general rather than a defect in this release. It means the signatures reduce risk while a device waits for its maintenance window; they do not remove the need to reach a fixed version.

The fix and its thresholds

Fixed versions include 12.2.4 and later for PAN-OS 12.2; 12.1.10-h2 and later for 12.1, with 12.1.4-h12 and 12.1.7-h8 also listed; 11.2.16 and later for 11.2, with 11.2.4-h22, 11.2.7-h21, 11.2.10-h15 and 11.2.13-h3 also listed; 11.1.16-h3 and later for 11.1, with 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35 and 11.1.13-h15 also listed; and 10.2.18-h12 and later for 10.2, with 10.2.7-h38, 10.2.10-h41, 10.2.13-h26 and 10.2.16-h11 also listed. No known workarounds exist. PAN-OS 11.2.16 carried an estimated availability of 15 October 2026.

Exposure context

A ZoomEye Search Dork of app="Palo Alto Networks" returned 22494 matching assets, and the CVE Filter vul.cve="CVE-2026-0322" returned zero. The Search count reflects fingerprint matches rather than vulnerable builds, and the filter result reflects absent CVE indexing. Neither number describes whether a given device has the four signature conditions in place.

References

• Palo Alto Networks Security Advisory CVE-2026-0322.
• Saudi NCSC CERT alert 2026-7933.