Why it matters
The newly disclosed CVE‑2026‑0322 lets an attacker who already has credentials log into the PAN‑OS management console and run code as root. With a CVSS of 8.6, the flaw can completely compromise firewalls, virtual appliances and Panorama controllers.
Technical details
The vulnerability resides in the management interface of PAN‑OS. Exploitation requires valid user credentials and network reachability to that interface. Once triggered, the attacker gains root privileges on the underlying Linux kernel.
Three IP addresses have been linked to active exploitation attempts:
- 66.42.72.14
- 208.83.239.114
- 149.248.47.234
Who is affected
All devices running PAN‑OS are in scope, specifically:
- PA‑Series firewalls
- VM‑Series firewalls
- Panorama virtual appliances
- M‑Series appliances
Cloud NGFW and Prisma Access are exempt.
Defensive steps
- Apply the patches released for PAN‑OS 10.2, 11.1, 11.2, 12.1 and 12.2. A follow‑up fix for 11.2.16 lands on 15 Oct.
- Block or restrict access to the management interface to trusted internal IP ranges only.
- Upgrade any legacy, unsupported PAN‑OS versions to a supported release.
- For U.S. federal agencies, comply with the CISA KEV directive and remediate by 17 Oct.
Palo Alto noted “very limited exploitation has been observed,” but independent verification of the exploitation level has not been provided.