CVE-2026-0322
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with r...
Affects 0 products across 1 vendor.
Attacker injects arbitrary code that is executed by the application process.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A high severity vulnerability (CVE-2026-0322) affects the target system. A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk ...
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-0322?
What is the CVSS score for CVE-2026-0322?
Is CVE-2026-0322 actively exploited?
How do I remediate CVE-2026-0322?
What systems are affected by CVE-2026-0322?
| CVE ID | CVE-2026-0322 |
|---|---|
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| Published | 2026-10-14 |
| Last Modified | 2026-10-15 |
| ICS Relevance | 80% |
| Weakness (CWE) | |
| Source | NVD |
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
Source: NIST NVD / MITRE CVE Database
| Vendor | Product | Affected Versions |
|---|---|---|
| Palo Alto Networks | — | — |
| Palo Alto Networks | Pan-Os | 10.2.7 10.2.8 10.2.9 10.2.10 10.2.11 10.2.12+49 more10.2.13 10.2.14 10.2.15 10.2.16 10.2.17 10.2.18 11.1.0 11.1.1 11.1.2 11.1.3 11.1.4 11.1.5 11.1.6 11.1.7 11.1.8 11.1.9 11.1.10 11.1.11 11.1.12 11.1.13 11.1.14 11.1.15 11.1.16 11.2.0 11.2.1 11.2.2 11.2.3 11.2.4 11.2.5 11.2.6 11.2.7 11.2.8 11.2.9 11.2.10 11.2.11 11.2.12 11.2.13 11.2.15 12.1.2 12.1.3 12.1.4 12.1.5 12.1.6 12.1.7 12.1.8 12.1.9 12.1.10 < 10.2.0 ≥ 12.2.0, < 12.2.4 |
| CISA known-exploited | ● Active Exploitation Confirmed (added 2026-10-14) |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
This Vulnerability Is Being Actively Exploited
CVE-2026-0322 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →