Palo Alto reports very limited exploitation of PAN-OS management-interface RCE

On October 14, Palo Alto Networks published an advisory for CVE-2026-0322, a remote code execution flaw in the PAN-OS management interface. An authenticated attacker with network access and high privileges can execute arbitrary code as root. Palo Alto assigns the issue CVSS 4.0 8.6 High and says very limited exploitation has been observed targeting its management interface. The advisory timeline was updated on October 15 to state that PAN-OS 11.2.16 has been published. (Palo Alto Networks advisory)

CISA's KEV catalog lists CVE-2026-0322 with an October 17, 2026 remediation deadline for Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04. That date is a federal agency deadline, not a general private-sector legal requirement. The KEV listing raises the operational priority while Palo Alto's advisory continues to describe observed exploitation as very limited. (CISA KEV catalog entry; CISA alert; CISA Binding Operational Directive 26-04)

The vendor lists PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances as affected. Cloud NGFW and Prisma Access are not affected. The advisory says no special configuration is required for exposure, and identifies management interfaces reachable from external IP addresses as the highest-risk case.

Fixed releases depend on the exact branch

Use the fixed release for the installed minor version. Palo Alto lists these upgrade targets:

• PAN-OS 12.2: Versions 12.2.0 through 12.2.3 should upgrade to 12.2.4 or later.
• PAN-OS 12.1: Versions 12.1.8 through 12.1.10-h should upgrade to 12.1.10-h2 or later. Versions 12.1.5 through 12.1.7-h should upgrade to 12.1.7-h8 or 12.1.10-h2 or later. Versions 12.1.2 through 12.1.4-h* should upgrade to 12.1.4-h12 or 12.1.10-h2 or later.
• PAN-OS 11.2: Versions 11.2.14 through 11.2.15 should upgrade to 11.2.16 or later. Versions 11.2.11 through 11.2.13-h should upgrade to 11.2.13-h3 or 11.2.16 or later. Versions 11.2.8 through 11.2.10-h should upgrade to 11.2.10-h15 or 11.2.16 or later. Versions 11.2.5 through 11.2.7-h should upgrade to 11.2.7-h21 or 11.2.16 or later. Versions 11.2.0 through 11.2.4-h should upgrade to 11.2.4-h22 or 11.2.16 or later.
• PAN-OS 11.1: Versions 11.1.14 through 11.1.16-h should upgrade to 11.1.16-h3 or later. Versions 11.1.11 through 11.1.13-h should upgrade to 11.1.13-h15 or 11.1.16-h3 or later. Versions 11.1.8 through 11.1.10-h should upgrade to 11.1.10-h35 or 11.1.16-h3 or later. Versions 11.1.7 through 11.1.7-h should upgrade to 11.1.7-h11 or 11.1.16-h3 or later. Versions 11.1.5 through 11.1.6-h should upgrade to 11.1.6-h39 or 11.1.16-h3 or later. Versions 11.1.0 through 11.1.4-h should upgrade to 11.1.4-h37 or 11.1.16-h3 or later.
• PAN-OS 10.2: Versions 10.2.17 through 10.2.18-h should upgrade to 10.2.18-h12 or later. Versions 10.2.14 through 10.2.16-h should upgrade to 10.2.16-h11 or 10.2.18-h12 or later. Versions 10.2.11 through 10.2.13-h should upgrade to 10.2.13-h26 or 10.2.18-h12 or later. Versions 10.2.8 through 10.2.10-h should upgrade to 10.2.10-h41 or 10.2.18-h12 or later. Versions 10.2.0 through 10.2.7-h* should upgrade to 10.2.7-h38 or 10.2.18-h12 or later.

Older unsupported PAN-OS versions should be upgraded to a supported fixed release. Confirm the target for the exact installed build in Palo Alto's current advisory.

Restrict management access and patch

Palo Alto lists no known workaround. Restrict management-interface access to trusted internal addresses or a jump host to reduce exposure while arranging the upgrade. Threat Prevention signatures 510046 and 510047 provide limited coverage. They require specific inspection conditions, including routing management traffic through a data-plane interface and SSL decryption. Palo Alto recommends upgrading to an unaffected version rather than relying on signature coverage.