CVE-2026–0322: The PAN-OS Zero-Day That Turns an Admin Login Into Root on the Firewall

Palo Alto Networks has patched an actively exploited code injection flaw in the PAN-OS management interface. Here's why "authenticated" is less comforting than it sounds.

On 14 October 2026, Palo Alto Networks published an advisory for CVE-2026–0322, a code injection vulnerability in the management interface of PAN-OS, the operating system that runs its firewalls. An attacker who can reach the management interface and log in as a high-privilege administrator can use it to execute arbitrary code as root on the device.

Palo Alto says it has already seen "very limited exploitation" targeting the management interface. The same day, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and gave US federal agencies until 17 October to fix it and check for compromise. Three days is one of the shortest remediation windows CISA sets.

At first glance, a bug that requires an admin login sounds low-risk. It is not, and the reasons why are the most important part of this story.

At a glance

CVE: CVE-2026–0322
Severity: CVSS 4.0 score 8.6 (High); Palo Alto's highest urgency rating
Weakness: CWE-94, improper control of generation of code (code injection)
Affected: PAN-OS on PA-Series and VM-Series firewalls, and Panorama (virtual and M-Series)
Not affected: Cloud NGFW and Prisma Access
Requirements: Network access to the management interface and a high-privilege authenticated session. No special configuration needed.
Impact: Arbitrary code execution with root privileges on the firewall
Status: Exploited in the wild ("very limited"); in CISA KEV with a 17 October 2026 federal deadline
Discovery: Found internally by Palo Alto Networks researcher Suraj Siddharudh
Workaround: None. Restricting management access reduces risk; patching fixes it.

What the vulnerability does

PAN-OS has two halves. The data plane inspects and forwards traffic. The management plane is where administrators configure the device, through a web interface, an XML/REST API and an SSH CLI. Admin accounts on the management plane are powerful, but they are still confined to the functions PAN-OS exposes: changing policy, committing configuration, viewing logs.

CVE-2026–0322 breaks that confinement. Palo Alto classifies it as CWE-94: somewhere in the management interface, input supplied by an authenticated user ends up being interpreted and executed as code. The result is execution on the underlying operating system as root, the highest privilege on the device, well beyond anything the admin role is supposed to allow.

Palo Alto has not published technical details of the vulnerable component or the exploit, and no public proof-of-concept was available at the time of writing.

"Authenticated" is not the comfort it sounds like

The CVSS vector lists Privileges Required: High, and that is the main reason the score is 8.6, not 9-plus. But treating this as low priority would be a mistake, for three reasons.

1. Admin credentials leak

As IDC's Yih Khai Wong pointed out to CSO Online, attackers can get admin credentials through phishing, password reuse, management interfaces reachable from the internet, or valid logins obtained in an earlier compromise. None of those require a new vulnerability.

2. A lot of firewall credentials were stolen in 2024

In November 2024, attackers chained CVE-2024–0012 (a management interface authentication bypass) with CVE-2024–9474 (privilege escalation to root). The Shadowserver Foundation counted roughly 2,000 compromised Palo Alto firewalls. According to Arctic Wolf, attackers exfiltrated firewall configuration files and the OS passwd and shadow files from some victims.

Configuration files contain admin password hashes and often credentials for LDAP, RADIUS and other integrations. Any organisation that patched in 2024 but never rotated its firewall admin passwords may have already handed attackers the "authenticated" half of CVE-2026–0322. This connection is my analysis, not something Palo Alto has stated. But it is exactly the kind of credential that turns a "requires admin" bug into a practical one.

3. Root on a firewall is a different category of compromise

An attacker with admin access can change rules. An attacker with root owns the box. On a firewall, that means:

Persistence below the admin layer. Implants on the operating system survive configuration reviews and are invisible from the web UI.
Quiet reconfiguration. Policies, NAT rules and logging can be altered while the evidence is suppressed.
Secrets. Firewalls hold VPN configuration, certificates, and in many deployments the private keys used for SSL decryption.
A trusted position. Every packet in and out of the network passes through the device. As researcher Vibhum Dubey put it to CSO Online, once attackers control a firewall they control the device that enforces network-wide security.

Panorama raises the stakes further, because it centrally manages fleets of firewalls. Root on Panorama is a path to every device it manages.

Who is exposed

Every supported PAN-OS branch is affected: 10.2, 11.1, 11.2, 12.1 and 12.2, along with older unsupported versions. Palo Alto's own scoring captures where the real risk is:

8.6 when the management interface is reachable from the network
8.5 when access is restricted to a jump box (attack vector drops to Adjacent)

Palo Alto describes the risk as highest when the management interface is open to the internet. Its long-standing best practice is that it should never be. That guidance is not always followed. In November 2024, Shadowserver counted around 11,000 PAN-OS management interfaces exposed to the internet, about 4,000 of them in the United States, before the number fell after the attacks. No updated count for this vulnerability had been published at the time of writing.

Fixed versions

Palo Alto has released fixes across every supported branch. If a hotfix for your exact maintenance release is not listed, move to the newest fixed release on your branch.

PAN-OS 12.2 (affected 12.2.0–12.2.3): fixed in 12.2.4 or later
PAN-OS 12.1 (affected 12.1.2–12.1.10-h*): fixed in 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2 and later
PAN-OS 11.2 (affected 11.2.0–11.2.15): fixed in 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16 and later
PAN-OS 11.1 (affected 11.1.0–11.1.16-h*): fixed in 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3 and later
PAN-OS 10.2 (affected 10.2.0–10.2.18-h*): fixed in 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, or 10.2.18-h12 and later
Unsupported versions: Upgrade to a supported fixed release

PAN-OS 11.2.16, the target for customers on 11.2.14 and 11.2.15, was listed with an expected release date of 15 October. Always confirm against the official advisory before upgrading, as hotfix lists can change.

A pattern, not a one-off

CVE-2026–0322 is the latest in a long run of actively exploited flaws on Palo Alto's internet-facing surfaces. CISA's KEV catalog now lists 16 Palo Alto vulnerabilities, three of them added in 2026.

April 2024, CVE-2024–3400: command injection in GlobalProtect, CVSS 10, exploited as a zero-day to drop the UPSTYLE backdoor. I broke that one down in Hiding in Plain Sight: Deconstructing the UPSTYLE Backdoor.
November 2024, CVE-2024–0012 + CVE-2024–9474: management interface authentication bypass chained to root; around 2,000 firewalls compromised.
February 2025, CVE-2025–0108: another management interface authentication bypass, exploited the day after Assetnote published details and chained with CVE-2024–9474 and CVE-2025–0111.
May 2026, CVE-2026–0300: a buffer overflow in the User-ID Authentication Portal giving unauthenticated root code execution.
May 2026, CVE-2026–0257: GlobalProtect authentication override cookie forgery; Rapid7 saw attackers use it to log in and obtain VPN addresses.
October 2026, CVE-2026–0322: this vulnerability.

The lesson is not specific to Palo Alto. Every major firewall and VPN vendor has a similar list. Edge devices are high-value, internet-facing and hard to monitor, which makes them one of the most reliable initial access routes for both state actors and ransomware groups. Treat their management planes as the crown jewels.

What to do now

1. Patch

Upgrade every firewall and Panorama instance to a fixed release. There is no workaround. Prioritise devices whose management interface is reachable from the internet or from large internal networks, and do not forget Panorama.

2. Lock down the management interface

Make the management interface reachable only from trusted internal IPs, ideally a single hardened jump box. Palo Alto's advisory calls this the main way to reduce risk, and it would have blunted every management interface bug in the timeline above. Remove any Interface Management Profile that exposes HTTPS, SSH or the API on an untrusted data-plane interface.

3. Treat credentials as part of the fix

Rotate every admin password on firewalls and Panorama, especially if the device was ever exposed during the 2024–2025 campaigns.
Remove unused and shared admin accounts; give every administrator a named account.
Enforce MFA for administrative access.
Apply least privilege: not every engineer needs superuser.

4. Use the interim protections, with their limits in mind

Customers with a Threat Prevention subscription can enable Threat IDs 510046 and 510047 (content 9159–10287 or later). Palo Alto describes this coverage as limited: it only works if inbound management traffic is routed through a data-plane interface and decrypted, and variants may not be detected. Treat it as a bridge to patching, not a replacement.

5. Hunt for compromise

Palo Alto published three IP addresses linked to exploit attempts:

66[.]42[.]72[.]14
208[.]83[.]239[.]114
149[.]248[.]47[.]234

66[.]42[.]72[.]14
208[.]83[.]239[.]114
149[.]248[.]47[.]234

Beyond those, look for:

Admin logins from unexpected sources, especially any source other than your jump box, and logins at unusual times.
New or modified admin accounts and roles you cannot account for.
Unexplained configuration commits, particularly to security policy, NAT, logging, or management settings.
Outbound connections initiated from the management interface to the internet.
Gaps in logs or a firewall that stops forwarding logs to your SIEM.

Note that traffic to the dedicated management port does not appear in the firewall's traffic logs. Use the system and configuration logs, and logs from whatever sits in front of the management network.

A starting point for a SIEM rule, to adapt to your own log schema:

title:  PAN-OS admin authentication from a non-jump-box source
logic:  pan-os system log
        WHERE subtype = "auth"
          AND event IN ("auth-success")
          AND source_ip NOT IN <jump_box_and_admin_allowlist>
level:  high
note:   Pair with config-log commits by the same admin within 30 minutes.

title:  PAN-OS admin authentication from a non-jump-box source
logic:  pan-os system log
        WHERE subtype = "auth"
          AND event IN ("auth-success")
          AND source_ip NOT IN <jump_box_and_admin_allowlist>
level:  high
note:   Pair with config-log commits by the same admin within 30 minutes.

If you find evidence of compromise, do forensic triage before making changes (CISA's directive requires the same of federal agencies): preserve logs and a tech support file, assume credentials and keys on the device are exposed, and rebuild rather than clean. A device that has been rooted cannot be trusted on its own word.

The takeaway

CVE-2026–0322 is not the most severe PAN-OS bug of the last two years. It needs a login, and the exploitation Palo Alto has seen is limited. But it lands on a product line that attackers have hammered repeatedly, on the most sensitive interface the device has, at a time when plenty of firewall credentials are already circulating from past breaches.

Patch it, but do not stop there. If your firewall's management interface is reachable from anywhere other than a jump box, or if your admin passwords are older than the 2024 attacks, fix that too.

This article reflects public information as of 15 October 2026. It will be updated if Palo Alto Networks publishes technical details, attribution or indicators of compromise.

Sources

Originally published at sohankanna.com.

Contents