Patch Palo Alto PAN-OS and Panorama: an exploited flaw gives logged-in attackers root, and there is no workaround

If you run Palo Alto Networks firewalls (PA-Series or VM-Series) or a Panorama management server, check your PAN-OS version today. A code injection flaw in the management interface lets an attacker who already has valid credentials run code as root on the device. Palo Alto’s advisory says it has seen “very limited” exploitation, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026.

The attacker needs a login and network access to the management interface. That makes this less alarming than an unauthenticated flaw, but stolen or reused admin credentials are common, and a management page reachable from the internet makes the risk much higher.

The details

• CVE: CVE-2026-0322, rated 8.6 (High) on the CVSS 4.0 scale
• Affected: PA-Series and VM-Series firewalls, and Panorama (virtual and M-Series). No special configuration is needed to be exposed.
• Not affected: Cloud NGFW and Prisma Access
• Exploitation: Confirmed by Palo Alto and listed in CISA’s KEV catalog. CISA’s due date for federal agencies is October 17, 2026. CISA lists ransomware use as unknown.
• Workaround: The advisory says none exists.

Fixed versions

Upgrade to the fixed release for your branch, or a later one. As of October 14, Palo Alto lists these:

Branch	Fixed in
12.2	12.2.4
12.1	12.1.4-h12, 12.1.7-h8, or 12.1.10-h2
11.2	11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16 (11.2.16 was due October 15)
11.1	11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3
10.2	10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, or 10.2.18-h12
Older, unsupported branches	No fix. Upgrade to a supported branch.

Match the fix to your current minor release (for example, 11.1.6 moves to 11.1.6-h39). The advisory has the complete list, so confirm there before you schedule the change.

Running an unsupported PAN-OS release? It’s affected and won’t get a patch. Put the upgrade on the calendar now, and lock down management access in the meantime.

What to do today

1. Find your version. In the web interface, look at the dashboard’s General Information widget, or run show system info from the command line and read the sw-version line. Check Panorama separately.
2. Check who can reach the management interface. It should answer only to a short list of trusted internal addresses, such as an admin subnet or jump box. If it answers from the internet, fix that first. The firewall review article covers what to look for.
3. Schedule the upgrade. Back up the configuration first, and plan for a reboot.
4. Review admin accounts. Remove any you don’t recognize, reset passwords for accounts that may be reused elsewhere, and make sure every admin login uses MFA where your setup supports it.
5. Look for signs of misuse. Check recent admin logins and configuration changes for anything you can’t explain. The advisory lists addresses tied to the observed attempts, so search your logs for them.

Partial protection until you can patch

Palo Alto says subscribers to the Threat Prevention service can get limited coverage by enabling two threat signatures (IDs 510046 and 510047, in content update 9159-10287 or later). This only works if you decrypt inbound management traffic, and it is not a substitute for patching.

The advisory also suggests steps that cut exposure: send management traffic through a data plane interface, replace the management certificate, decrypt inbound management traffic, and restrict management access to a jump box. Follow the advisory’s wording for these, because they involve certificate and interface changes you shouldn’t improvise.

If you manage this for a government agency or bank, tell your CSA (CJIS Systems Agency), examiner, or compliance contact according to your own incident process. This article can’t tell you whether a given environment must report anything.

Sources

• CVE-2026-0322 advisory (Palo Alto Networks): description, affected and fixed versions, exploitation status, mitigations
• Known Exploited Vulnerabilities catalog (CISA): CVE-2026-0322 added October 14, 2026, due date October 17, 2026