CVE-2026-0322: PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

Published Oct 14, 2026
·
Updated

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Other sources

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431).

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

— Palo Alto Networks

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

— CISA

Affected Software

256 affected componentsFixes available
Palo Alto Networks PAN-OS
Palo Alto Networks Cloud NGFW
Palo Alto Networks PAN-OS<12.2.4, =12.2.0, =12.1.0, =11.2.0, =11.1.0, =10.2.0
12.2.412.1.4-h1212.1.7-h812.1.10-h211.2.4-h2211.2.7-h2111.2.10-h1511.2.13-h311.2.1611.1.4-h3711.1.6-h3911.1.7-h1111.1.10-h3511.1.13-h1511.1.16-h310.2.7-h3810.2.10-h4110.2.13-h2610.2.16-h1110.2.18-h12
Palo Alto Networks Prisma Access
Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS<10.2.0
Palo Alto Networks PAN-OS>=12.2.0<12.2.4
Palo Alto Networks PAN-OS=10.2.7
Palo Alto Networks PAN-OS=10.2.7-h1
Palo Alto Networks PAN-OS=10.2.7-h12
Palo Alto Networks PAN-OS=10.2.7-h16
Palo Alto Networks PAN-OS=10.2.7-h18
Palo Alto Networks PAN-OS=10.2.7-h19
Palo Alto Networks PAN-OS=10.2.7-h21
Palo Alto Networks PAN-OS=10.2.7-h24
Palo Alto Networks PAN-OS=10.2.7-h3
Palo Alto Networks PAN-OS=10.2.7-h32
Palo Alto Networks PAN-OS=10.2.7-h34
Palo Alto Networks PAN-OS=10.2.7-h35
Palo Alto Networks PAN-OS=10.2.7-h36
Palo Alto Networks PAN-OS=10.2.7-h37
Palo Alto Networks PAN-OS=10.2.7-h6
Palo Alto Networks PAN-OS=10.2.7-h8
Palo Alto Networks PAN-OS=10.2.8
Palo Alto Networks PAN-OS=10.2.9
Palo Alto Networks PAN-OS=10.2.10
Palo Alto Networks PAN-OS=10.2.10-h10
Palo Alto Networks PAN-OS=10.2.10-h12
Palo Alto Networks PAN-OS=10.2.10-h14
Palo Alto Networks PAN-OS=10.2.10-h17
Palo Alto Networks PAN-OS=10.2.10-h18
Palo Alto Networks PAN-OS=10.2.10-h2
Palo Alto Networks PAN-OS=10.2.10-h21
Palo Alto Networks PAN-OS=10.2.10-h27
Palo Alto Networks PAN-OS=10.2.10-h3
Palo Alto Networks PAN-OS=10.2.10-h30
Palo Alto Networks PAN-OS=10.2.10-h31
Palo Alto Networks PAN-OS=10.2.10-h36
Palo Alto Networks PAN-OS=10.2.10-h37
Palo Alto Networks PAN-OS=10.2.10-h39
Palo Alto Networks PAN-OS=10.2.10-h4
Palo Alto Networks PAN-OS=10.2.10-h40
Palo Alto Networks PAN-OS=10.2.10-h5
Palo Alto Networks PAN-OS=10.2.10-h7
Palo Alto Networks PAN-OS=10.2.10-h9
Palo Alto Networks PAN-OS=10.2.11
Palo Alto Networks PAN-OS=10.2.12
Palo Alto Networks PAN-OS=10.2.13
Palo Alto Networks PAN-OS=10.2.13-h1
Palo Alto Networks PAN-OS=10.2.13-h10
Palo Alto Networks PAN-OS=10.2.13-h15
Palo Alto Networks PAN-OS=10.2.13-h16
Palo Alto Networks PAN-OS=10.2.13-h18
Palo Alto Networks PAN-OS=10.2.13-h2
Palo Alto Networks PAN-OS=10.2.13-h21
Palo Alto Networks PAN-OS=10.2.13-h22
Palo Alto Networks PAN-OS=10.2.13-h23
Palo Alto Networks PAN-OS=10.2.13-h24
Palo Alto Networks PAN-OS=10.2.13-h3
Palo Alto Networks PAN-OS=10.2.13-h4
Palo Alto Networks PAN-OS=10.2.13-h5
Palo Alto Networks PAN-OS=10.2.13-h7
Palo Alto Networks PAN-OS=10.2.14
Palo Alto Networks PAN-OS=10.2.15
Palo Alto Networks PAN-OS=10.2.16
Palo Alto Networks PAN-OS=10.2.16-h1
Palo Alto Networks PAN-OS=10.2.16-h10
Palo Alto Networks PAN-OS=10.2.16-h4
Palo Alto Networks PAN-OS=10.2.16-h6
Palo Alto Networks PAN-OS=10.2.16-h7
Palo Alto Networks PAN-OS=10.2.16-h8
Palo Alto Networks PAN-OS=10.2.16-h9
Palo Alto Networks PAN-OS=10.2.17
Palo Alto Networks PAN-OS=10.2.18
Palo Alto Networks PAN-OS=10.2.18-h1
Palo Alto Networks PAN-OS=10.2.18-h10
Palo Alto Networks PAN-OS=10.2.18-h5
Palo Alto Networks PAN-OS=10.2.18-h6
Palo Alto Networks PAN-OS=10.2.18-h7
Palo Alto Networks PAN-OS=10.2.18-h8
Palo Alto Networks PAN-OS=10.2.18-h9
Palo Alto Networks PAN-OS=11.1.0
Palo Alto Networks PAN-OS=11.1.1
Palo Alto Networks PAN-OS=11.1.2
Palo Alto Networks PAN-OS=11.1.3
Palo Alto Networks PAN-OS=11.1.4
Palo Alto Networks PAN-OS=11.1.4-h1
Palo Alto Networks PAN-OS=11.1.4-h13
Palo Alto Networks PAN-OS=11.1.4-h15
Palo Alto Networks PAN-OS=11.1.4-h16
Palo Alto Networks PAN-OS=11.1.4-h17
Palo Alto Networks PAN-OS=11.1.4-h18
Palo Alto Networks PAN-OS=11.1.4-h25
Palo Alto Networks PAN-OS=11.1.4-h27
Palo Alto Networks PAN-OS=11.1.4-h32
Palo Alto Networks PAN-OS=11.1.4-h33
Palo Alto Networks PAN-OS=11.1.4-h34
Palo Alto Networks PAN-OS=11.1.4-h35
Palo Alto Networks PAN-OS=11.1.4-h36
Palo Alto Networks PAN-OS=11.1.4-h4
Palo Alto Networks PAN-OS=11.1.4-h7
Palo Alto Networks PAN-OS=11.1.4-h9
Palo Alto Networks PAN-OS=11.1.5
Palo Alto Networks PAN-OS=11.1.6
Palo Alto Networks PAN-OS=11.1.6-h1
Palo Alto Networks PAN-OS=11.1.6-h10
Palo Alto Networks PAN-OS=11.1.6-h14
Palo Alto Networks PAN-OS=11.1.6-h17
Palo Alto Networks PAN-OS=11.1.6-h18
Palo Alto Networks PAN-OS=11.1.6-h19
Palo Alto Networks PAN-OS=11.1.6-h2
Palo Alto Networks PAN-OS=11.1.6-h20
Palo Alto Networks PAN-OS=11.1.6-h21
Palo Alto Networks PAN-OS=11.1.6-h22
Palo Alto Networks PAN-OS=11.1.6-h23
Palo Alto Networks PAN-OS=11.1.6-h25
Palo Alto Networks PAN-OS=11.1.6-h29
Palo Alto Networks PAN-OS=11.1.6-h3
Palo Alto Networks PAN-OS=11.1.6-h32
Palo Alto Networks PAN-OS=11.1.6-h33
Palo Alto Networks PAN-OS=11.1.6-h34
Palo Alto Networks PAN-OS=11.1.6-h35
Palo Alto Networks PAN-OS=11.1.6-h36
Palo Alto Networks PAN-OS=11.1.6-h38
Palo Alto Networks PAN-OS=11.1.6-h4
Palo Alto Networks PAN-OS=11.1.6-h5
Palo Alto Networks PAN-OS=11.1.6-h6
Palo Alto Networks PAN-OS=11.1.6-h7
Palo Alto Networks PAN-OS=11.1.7
Palo Alto Networks PAN-OS=11.1.7-h1
Palo Alto Networks PAN-OS=11.1.7-h10
Palo Alto Networks PAN-OS=11.1.7-h2
Palo Alto Networks PAN-OS=11.1.7-h4
Palo Alto Networks PAN-OS=11.1.7-h6
Palo Alto Networks PAN-OS=11.1.7-h8
Palo Alto Networks PAN-OS=11.1.8
Palo Alto Networks PAN-OS=11.1.9
Palo Alto Networks PAN-OS=11.1.10
Palo Alto Networks PAN-OS=11.1.10-h1
Palo Alto Networks PAN-OS=11.1.10-h10
Palo Alto Networks PAN-OS=11.1.10-h12
Palo Alto Networks PAN-OS=11.1.10-h21
Palo Alto Networks PAN-OS=11.1.10-h25
Palo Alto Networks PAN-OS=11.1.10-h26
Palo Alto Networks PAN-OS=11.1.10-h27
Palo Alto Networks PAN-OS=11.1.10-h28
Palo Alto Networks PAN-OS=11.1.10-h30
Palo Alto Networks PAN-OS=11.1.10-h32
Palo Alto Networks PAN-OS=11.1.10-h33
Palo Alto Networks PAN-OS=11.1.10-h4
Palo Alto Networks PAN-OS=11.1.10-h5
Palo Alto Networks PAN-OS=11.1.10-h7
Palo Alto Networks PAN-OS=11.1.10-h9
Palo Alto Networks PAN-OS=11.1.11
Palo Alto Networks PAN-OS=11.1.12
Palo Alto Networks PAN-OS=11.1.13
Palo Alto Networks PAN-OS=11.1.13-h1
Palo Alto Networks PAN-OS=11.1.13-h10
Palo Alto Networks PAN-OS=11.1.13-h11
Palo Alto Networks PAN-OS=11.1.13-h12
Palo Alto Networks PAN-OS=11.1.13-h2
Palo Alto Networks PAN-OS=11.1.13-h3
Palo Alto Networks PAN-OS=11.1.13-h5
Palo Alto Networks PAN-OS=11.1.13-h6
Palo Alto Networks PAN-OS=11.1.13-h7
Palo Alto Networks PAN-OS=11.1.13-h8
Palo Alto Networks PAN-OS=11.1.13-h9
Palo Alto Networks PAN-OS=11.1.14
Palo Alto Networks PAN-OS=11.1.15
Palo Alto Networks PAN-OS=11.1.16
Palo Alto Networks PAN-OS=11.1.16-h1
Palo Alto Networks PAN-OS=11.1.16-h2
Palo Alto Networks PAN-OS=11.2.0
Palo Alto Networks PAN-OS=11.2.1
Palo Alto Networks PAN-OS=11.2.2
Palo Alto Networks PAN-OS=11.2.3
Palo Alto Networks PAN-OS=11.2.4
Palo Alto Networks PAN-OS=11.2.4-h1
Palo Alto Networks PAN-OS=11.2.4-h10
Palo Alto Networks PAN-OS=11.2.4-h11
Palo Alto Networks PAN-OS=11.2.4-h12
Palo Alto Networks PAN-OS=11.2.4-h14
Palo Alto Networks PAN-OS=11.2.4-h15
Palo Alto Networks PAN-OS=11.2.4-h17
Palo Alto Networks PAN-OS=11.2.4-h18
Palo Alto Networks PAN-OS=11.2.4-h2
Palo Alto Networks PAN-OS=11.2.4-h20
Palo Alto Networks PAN-OS=11.2.4-h4
Palo Alto Networks PAN-OS=11.2.4-h5
Palo Alto Networks PAN-OS=11.2.4-h6
Palo Alto Networks PAN-OS=11.2.4-h7
Palo Alto Networks PAN-OS=11.2.4-h8
Palo Alto Networks PAN-OS=11.2.4-h9
Palo Alto Networks PAN-OS=11.2.5
Palo Alto Networks PAN-OS=11.2.6
Palo Alto Networks PAN-OS=11.2.7
Palo Alto Networks PAN-OS=11.2.7-h1
Palo Alto Networks PAN-OS=11.2.7-h10
Palo Alto Networks PAN-OS=11.2.7-h11
Palo Alto Networks PAN-OS=11.2.7-h12
Palo Alto Networks PAN-OS=11.2.7-h13
Palo Alto Networks PAN-OS=11.2.7-h14
Palo Alto Networks PAN-OS=11.2.7-h15
Palo Alto Networks PAN-OS=11.2.7-h16
Palo Alto Networks PAN-OS=11.2.7-h17
Palo Alto Networks PAN-OS=11.2.7-h18
Palo Alto Networks PAN-OS=11.2.7-h19
Palo Alto Networks PAN-OS=11.2.7-h2
Palo Alto Networks PAN-OS=11.2.7-h3
Palo Alto Networks PAN-OS=11.2.7-h4
Palo Alto Networks PAN-OS=11.2.7-h7
Palo Alto Networks PAN-OS=11.2.7-h8
Palo Alto Networks PAN-OS=11.2.8
Palo Alto Networks PAN-OS=11.2.9
Palo Alto Networks PAN-OS=11.2.10
Palo Alto Networks PAN-OS=11.2.10-h1
Palo Alto Networks PAN-OS=11.2.10-h10
Palo Alto Networks PAN-OS=11.2.10-h12
Palo Alto Networks PAN-OS=11.2.10-h13
Palo Alto Networks PAN-OS=11.2.10-h2
Palo Alto Networks PAN-OS=11.2.10-h3
Palo Alto Networks PAN-OS=11.2.10-h4
Palo Alto Networks PAN-OS=11.2.10-h5
Palo Alto Networks PAN-OS=11.2.10-h6
Palo Alto Networks PAN-OS=11.2.10-h7
Palo Alto Networks PAN-OS=11.2.10-h8
Palo Alto Networks PAN-OS=11.2.10-h9
Palo Alto Networks PAN-OS=11.2.11
Palo Alto Networks PAN-OS=11.2.12
Palo Alto Networks PAN-OS=11.2.13
Palo Alto Networks PAN-OS=11.2.13-h1
Palo Alto Networks PAN-OS=11.2.13-h2
Palo Alto Networks PAN-OS=11.2.15
Palo Alto Networks PAN-OS=12.1.2
Palo Alto Networks PAN-OS=12.1.3
Palo Alto Networks PAN-OS=12.1.4
Palo Alto Networks PAN-OS=12.1.4-h10
Palo Alto Networks PAN-OS=12.1.4-h11
Palo Alto Networks PAN-OS=12.1.4-h2
Palo Alto Networks PAN-OS=12.1.4-h3
Palo Alto Networks PAN-OS=12.1.4-h5
Palo Alto Networks PAN-OS=12.1.4-h6
Palo Alto Networks PAN-OS=12.1.4-h7
Palo Alto Networks PAN-OS=12.1.4-h8
Palo Alto Networks PAN-OS=12.1.4-h9
Palo Alto Networks PAN-OS=12.1.5
Palo Alto Networks PAN-OS=12.1.6
Palo Alto Networks PAN-OS=12.1.7
Palo Alto Networks PAN-OS=12.1.7-h1
Palo Alto Networks PAN-OS=12.1.7-h2
Palo Alto Networks PAN-OS=12.1.7-h3
Palo Alto Networks PAN-OS=12.1.7-h5
Palo Alto Networks PAN-OS=12.1.7-h6
Palo Alto Networks PAN-OS=12.1.8
Palo Alto Networks PAN-OS=12.1.9
Palo Alto Networks PAN-OS=12.1.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 12.2.4Fixed in 12.1.4-h12Fixed in 12.1.7-h8Fixed in 12.1.10-h2Fixed in 11.2.4-h22Fixed in 11.2.7-h21Fixed in 11.2.10-h15Fixed in 11.2.13-h3Fixed in 11.2.16Fixed in 11.1.4-h37Fixed in 11.1.6-h39Fixed in 11.1.7-h11Fixed in 11.1.10-h35Fixed in 11.1.13-h15Fixed in 11.1.16-h3Fixed in 10.2.7-h38Fixed in 10.2.10-h41Fixed in 10.2.13-h26Fixed in 10.2.16-h11Fixed in 10.2.18-h12
  2. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.7-h38
  3. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.18-h12
  4. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.13-h26
  5. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.16-h11
  6. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.10-h41
  7. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.4-h37
  8. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.16-h3
  9. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.13-h15
  10. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.6-h39
  11. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.7-h11
  12. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.10-h35
  13. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.4-h22
  14. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.16
  15. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.13-h3
  16. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.7-h21
  17. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.10-h15
  18. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 12.1.4-h12
  19. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 12.1.10-h2
  20. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 12.1.7-h8
  21. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 12.2.4
  22. Configuration

    Decrypt inbound traffic to the management interface so the firewall can inspect it.

    PAN-OS management interface Inbound traffic decryption = enabled
  23. Configuration

    Enable Threat Prevention on inbound traffic to management services.

    PAN-OS management services Threat Prevention = enabled
  24. Configuration

    Replace the Certificate for Inbound Traffic Management.

    PAN-OS management interface Certificate for Inbound Traffic Management = replacement certificate
  25. Configuration

    Route incoming traffic for the MGT port through a DP port, such as by enabling a management profile on a DP interface for management access.

    PAN-OS management access MGT port routing = DP port
  26. Configuration

    Enable Threat ID 510046 and Threat ID 510047 from Applications and Threats content version 9159-10287 and later; this protection requires SSL Decryption.

    PAN-OS Threat Prevention Threat ID 510046 and Threat ID 510047 = enabled
  27. Compensating control

    Restrict access to the management interface to only trusted internal IP addresses.

Event History

Oct 14, 2026
CVE Published
via CISA·12:00 AM
Data Sourced
via CISA·12:00 AM
RemedyDescriptionWeaknessAffected Software
Advisory Published
via Palo Alto Networks·04:00 PM
Data Sourced
via Palo Alto Networks·04:00 PM
RemedyDescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·05:26 PM
Data Sourced
via MITRE·05:26 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeaknessAffected Software
Oct 15, 2026
Advisory Published
via Palo Alto Networks·06:30 PM

Frequently Asked Questions

1

Which deployments are affected, and which are not?

The issue applies to PAN-OS on PA-Series and VM-Series firewalls and to Panorama virtual and M-Series systems. Cloud NGFW and Prisma Access are not impacted.

2

What access does an attacker need to exploit this issue?

An attacker needs network access to the management interface and authenticated access. Successful exploitation allows arbitrary code execution with root privileges on the firewall.

3

Are systems with publicly reachable management interfaces at greater risk?

Yes. The stated risk reduction is to restrict management-interface access to trusted internal IP addresses; systems that expose this interface to broader networks have a larger potential attacker population.

4

What can be done if patching cannot be completed immediately?

Restrict management-interface access to trusted internal IP addresses in line with the recommended deployment guidance. This reduces exposure but does not remove the vulnerability.

5

Is this vulnerability known to be exploited?

Yes. It is flagged as exploited and was added to the KEV list on 2026-10-14.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203