PAN-OS CVE-2026-0322: Authenticated Code Injection in Management Interface Leads to Root Privileges

1. Basic Information

• Report Title: CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
• Publisher: Palo Alto Networks
• Publication Date: 2026-10-14
• Update Date: 2026-10-15
• Original Source: Palo Alto Networks
• Related Source: SecurityWeek: Palo Alto Networks Patches Exploited Firewall Vulnerability
• Related Malware: None
• Related Threat Actor: None
• Related CVE: CVE-2026-0322
• Related Products: PAN-OS on PA-Series, PAN-OS on VM-Series, Panorama virtual / M-Series
• Severity: Critical

The official CVSS score is 8.6 HIGH. However, exploitation leads to root privileges on the firewall or Panorama management interface, and active exploitation has been confirmed. Public-facing management interfaces must be restricted immediately, and branch-specific fixed versions must be applied.

2. Executive Summary

A code injection vulnerability in the PAN-OS management interface allows remote code execution with root privileges, requiring network reachability and authentication with high privileges (PR:H) based on the official CVSS. Palo Alto Networks has disclosed very limited active exploitation and three related IPs.

3. Attack Flow

Path 1: Exploitation Conditions from Public Information

1. An attacker reaches the PAN-OS management interface over the network.
2. The attacker exploits vulnerable input processing in the management interface while authenticated with high privileges. The official CVSS specifies PR:H, but details regarding how authentication is obtained and individual roles remain unpublished.
3. Successful exploitation allows the execution of arbitrary code with root privileges on the firewall.
4. Subsequent actions in individual attacks have not been disclosed; therefore, the impact on configurations, credentials, and traffic must be determined via internal telemetry.

4. Attacker Positioning and Execution Location

• An attacker who reaches the management interface over the network and possesses the high-privilege authentication required for exploitation. The required privilege level is PR:H per the official CVSS.

5. Visibility for Victims and Administrators

• Victims and Users: Ordinary users may not observe any noticeable changes.
• Administrators: May observe management logins from unknown sources, abnormal requests, unusual processes, configuration changes, or outbound traffic originating from the firewall itself.

6. Success and Failure Conditions

Success Conditions

• Running a vulnerable PAN-OS version.
• Network reachability to the management interface and possession of authentication classified as high privileges (PR:H) in the official CVSS.

Failure Conditions and Mitigations

• Update to the official fixed version. There are no known workarounds.
• Restrict access to the management interface to trusted internal IP addresses or a jump box.

7. Impact of Successful Exploitation

• Arbitrary code is executed with root privileges on the firewall or Panorama.
• Inference: Root privileges could severely impact security policies, configurations, credentials, and traffic visibility. Subsequent operations for individual incidents have not been publicly disclosed.

8. Observable Logs

The following are candidates for investigation within your organization. Availability depends on products, permissions, log settings, and retention periods. The absence of records does not prove an environment is uncompromised.

• Email: No email vectors specific to this issue have been identified.
• Proxy / SWG / DNS: Inference: Check for requests originating from published IPs or unknown sources targeting the management interface.
• Endpoint / EDR: Inference: Check PAN-OS system logs, process and crash information, unknown files, and traces of root execution.
• Identity / IdP: Inference: Check management logins, MFA, jump servers, VPNs, and service account usage.
• SaaS / Cloud: Inference: Check operation history for Panorama, the support portal, and configuration backups.
• Network: Inference: Check for communication with 66.42.72.14, 208.83.239.114, and 149.248.47.234, as well as abnormal outbound traffic originating from the firewall.

9. Determining Attack Success

Confirmed in Public Information

Palo Alto Networks has reported very limited active exploitation. Root commands and subsequent actions for individual incidents have not been publicly disclosed.

Internal Assessment Criteria

• Initial Execution Confirmed: Assessment criterion: This stage is determined if evidence supports code execution following the exploitation of the management interface within your organization. While public information indicates vendor reports of very limited exploitation, evidence of root commands or subsequent operations in individual incidents has not been disclosed. Scope: Internal assessment criteria, distinct from the exploitation scope published by the vendor.

Separate contact, execution, persistence, data collection, and exfiltration; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

• Investigation Starting Point: Focus on vulnerable versions, publicly exposed management interfaces, published IPs, and unknown management logins.
• Initial Verification: Check the model, PAN-OS branch, hotfixes, management interface exposure scope, and authenticated users.
• Endpoint / Server Investigation: Preserve system logs, configuration diffs, process and crash data, and unknown files.
• Identity / Cloud Investigation: Review usage history for management accounts, MFA, VPNs, jump servers, and API keys.
• Subsequent Operations: Track policy changes, credential access, internal reconnaissance, and outbound traffic.
• Containment: Restrict the management interface, update to a fixed version after preserving evidence, and rotate management credentials and keys.
• Categorization: Separate reachability, authentication, exploit attempts, root execution, configuration changes, and subsequent communication.

11. Defense and Detection Ideas

• Single Event: Prioritize management access and abnormal management requests originating from published IPs.
• Timeline Correlation: Correlate management logins -> abnormal requests -> root processes -> configuration changes or outbound traffic.
• Threat Hunting: Inventory the versions and management interface exposure status for all PA-Series, VM-Series, and Panorama instances.
• Log Limitations: Logs within the appliance may become untrustworthy after root compromise; external syslog and network records are required.
• Priority Mitigations: Apply fixed versions, restrict management interfaces to trusted networks, enforce MFA, and configure external log forwarding.

12. Facts, Inference, and Hypothesis

Facts

• CVE-2026-0322 is a code injection vulnerability in the PAN-OS management interface with a CVSS score of 8.6 and CWE-94.
• Exploitation requires network reachability to the management interface and high-privilege authentication (official CVSS PR:H), allowing arbitrary code execution with root privileges upon exploitation.
• PA-Series, VM-Series, and Panorama virtual / M-Series are affected; Cloud NGFW and Prisma Access are not affected.
• Palo Alto Networks confirmed very limited active exploitation.
• Related IPs published are 66.42.72.14, 208.83.239.114, and 149.248.47.234.
• Fixed versions include 12.2.4, 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2, 11.2.4-h22 / 11.2.7-h21 / 11.2.10-h15 / 11.2.13-h3 / 11.2.16, and designated hotfixes for the 11.1 and 10.2 branches.
• There are no known workarounds. Threat IDs 510046 and 510047 provide limited protection under specific decryption and routing conditions, but do not replace updates.

Inference

• Because high-privilege authentication is required, management credentials and access paths must be verified. Public information does not disclose how credentials were obtained or the individual intrusion vectors used.

Hypothesis

No additional hypotheses. Unconfirmed items are noted in "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1078	Valid Accounts	medium	Exploitation requires authentication, but it remains unpublished whether legitimate credentials were used in actual attacks. Source
T1190	Exploit Public-Facing Application	high	Exploits a vulnerability in a network-reachable management interface. Source

14. Unknowns and Additional Investigation

• The threat actor, number of victims, method of obtaining credentials, executed commands, and the presence of persistence or data access have not been publicly disclosed.

15. Impact on SOCs and Organizations

Even if authentication is required, an attacker with high-privilege authentication in the management plane can exploit this vulnerability to execute code as root. Therefore, both authentication and access restrictions must be maintained. Organizations exposing management interfaces should prioritize updates, correlate authentication, configuration changes, and execution artifacts in external logs, and judge update completion separately from compromise investigations.

16. Summary by Role

• For SOCs: Check for published IPs, management logins, code execution, configuration changes, and outbound traffic originating from the firewall.
• For Administrators: Restrict management interfaces to trusted IPs or jump boxes, and immediately update the running branch to the official fixed version.
• For Users: No user action is required. Follow any instructions regarding VPNs or credential changes provided by administrators.