CVE-2026-0322: Authenticated root RCE in the management interface

What it is

A code injection flaw (CWE-94) in the PAN-OS management interface lets an authenticated attacker run arbitrary code as root on the firewall. It affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected.

The attacker needs valid management credentials, which is why the score is 8.6 (high) rather than critical. That is not much comfort. Palo Alto Networks says it has seen very limited exploitation and rates the exploit maturity as “attacked”. CISA added the CVE to the KEV catalog on October 14, with a due date of October 17. The KEV entry lists ransomware use as unknown. We found no public proof of concept.

Management interfaces have been a repeated target. Stolen or weak admin credentials, or a chained authentication bypass such as CVE-2025-0108, turn a “needs login” bug into a root compromise. Treat this as urgent if your management interface is reachable from the internet.

Am I affected?

You’re affected if you run PAN-OS in the version ranges in the table above. The advisory says no special configuration is needed. Risk is highest when the management interface is reachable from the internet, and lower when only trusted internal IP addresses can reach it. Palo Alto Networks also scores a jump-box scenario (attack vector adjacent) at 8.5.

Not affected: Cloud NGFW and Prisma Access.

Check your version from the CLI:

show system info | match sw-version

Then find out who can reach the management interface. The advisory points to Palo Alto Networks’ best-practice guidance for securing management access but gives no menu paths for checking exposure. Check your management profiles, the MGT port’s network placement, and any internet scan results for your management IPs.

What to do

1. Upgrade to a fixed version for your train (see the table above). Pick the newest build available. The 11.2.16 release was listed with an expected date of 10/15, so check that it has shipped before you plan around it.
2. Take the management interface off the internet and limit it to trusted internal IPs. This is the vendor’s main risk reduction. Ideally allow only a single jump box.
3. There is no known workaround. The advisory lists these hardening steps, with links to vendor documentation:
   • Route inbound management traffic through a data-plane port, for example with a management profile on a data-plane interface.
   • Replace the certificate used for inbound management traffic.
   • Decrypt inbound management traffic so the firewall can inspect it.
   • Enable Threat Prevention on inbound traffic to management services.
4. Threat Prevention customers: enable Threat IDs 510046 and 510047 (Applications and Threats content 9159-10287 or later). They need SSL Decryption. The vendor says coverage is limited and variants may not be detected, so this does not replace patching.
5. If the management interface was reachable from the internet before you fixed it, assume possible compromise. Review admin accounts and recent commits, check the logs for the indicators below, and rotate admin credentials, API keys and any secrets stored on the device. Follow CISA’s forensic triage requirements in BOD 26-04 if you are a US federal agency.

Detection

Palo Alto Networks lists three IP addresses associated with threat activity and limited exploit attempts: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. Search management-interface, system and authentication logs for these addresses, and for any successful admin login from an address outside your trusted management ranges.

The advisory publishes no log signatures, file paths or hashes. Beyond the addresses above, look for admin logins at unexpected times, new or changed admin accounts, and configuration changes nobody on your team made. Treat these as general hunting leads, not published indicators for this CVE.