CVE-2026-0322: PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (Severity: HIGH)

Published Oct 14, 2026
·
Updated

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Other sources

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431).

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

— Palo Alto Networks

Affected Software

4 affected componentsFixes available
Palo Alto Networks PAN-OS
Palo Alto Networks Cloud NGFW
Palo Alto Networks PAN-OS<12.2.4, =12.2.0, =12.1.0, =11.2.0, =11.1.0, =10.2.0
12.2.412.1.4-h1212.1.7-h812.1.10-h211.2.4-h2211.2.7-h2111.2.10-h1511.2.13-h311.2.1611.1.4-h3711.1.6-h3911.1.7-h1111.1.10-h3511.1.13-h1511.1.16-h310.2.7-h3810.2.10-h4110.2.13-h2610.2.16-h1110.2.18-h12
Palo Alto Networks Prisma Access

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 12.2.4Fixed in 12.1.4-h12Fixed in 12.1.7-h8Fixed in 12.1.10-h2Fixed in 11.2.4-h22Fixed in 11.2.7-h21Fixed in 11.2.10-h15Fixed in 11.2.13-h3Fixed in 11.2.16Fixed in 11.1.4-h37Fixed in 11.1.6-h39Fixed in 11.1.7-h11Fixed in 11.1.10-h35Fixed in 11.1.13-h15Fixed in 11.1.16-h3Fixed in 10.2.7-h38Fixed in 10.2.10-h41Fixed in 10.2.13-h26Fixed in 10.2.16-h11Fixed in 10.2.18-h12
  2. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.7-h38
  3. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.18-h12
  4. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.13-h26
  5. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.16-h11
  6. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 10.2.10-h41
  7. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.4-h37
  8. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.16-h3
  9. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.13-h15
  10. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.6-h39
  11. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.7-h11
  12. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.1.10-h35
  13. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.4-h22
  14. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.16
  15. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.13-h3
  16. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.7-h21
  17. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.10-h15
  18. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 12.1.4-h12
  19. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 12.1.10-h2
  20. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 12.1.7-h8
  21. Upgrade

    Upgrade Palo Alto Networks PAN-OS to a version that resolves this vulnerability.

    Fixed in 12.2.4
  22. Configuration

    Decrypt inbound traffic to the management interface so the firewall can inspect it.

    PAN-OS management interface SSL Decryption = enabled
  23. Configuration

    Enable Threat Prevention on inbound traffic to management services and enable Threat IDs 510046 and 510047; this protection requires SSL Decryption.

    PAN-OS management services Threat Prevention = enabled; Threat IDs 510046 and 510047 from Applications and Threats content version 9159-10287 and later
  24. Configuration

    Replace the Certificate for Inbound Traffic Management.

    PAN-OS management interface Certificate for Inbound Traffic Management = replaced
  25. Configuration

    Route incoming traffic for the MGT port through a DP port, such as by enabling a management profile on a DP interface for management access.

    PAN-OS MGT access Management profile on a DP interface = enabled
  26. Compensating control

    Restrict access to the management interface to only trusted internal IP addresses.

Event History

Oct 14, 2026
Advisory Published
via Palo Alto Networks·04:00 PM
Known Exploited
via Palo Alto Networks·04:00 PM
Data Sourced
via Palo Alto Networks·04:00 PM
RemedyDescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·05:26 PM
Data Sourced
via MITRE·05:26 PM
DescriptionWeakness

Frequently Asked Questions

1

Which deployments are affected, and which are not?

The issue applies to PAN-OS on PA-Series and VM-Series firewalls and to Panorama virtual and M-Series systems. Cloud NGFW and Prisma Access are not impacted.

2

What access does an attacker need to exploit this issue?

An attacker needs network access to the management interface and authenticated access. Successful exploitation allows arbitrary code execution with root privileges on the firewall.

3

Are systems with publicly reachable management interfaces at greater risk?

Yes. The stated risk reduction is to restrict management-interface access to trusted internal IP addresses; systems that expose this interface to broader networks have a larger potential attacker population.

4

What can be done if patching cannot be completed immediately?

Restrict management-interface access to trusted internal IP addresses in line with the recommended deployment guidance. This reduces exposure but does not remove the vulnerability.

5

Is this vulnerability known to be exploited?

Yes. It is flagged as exploited and was added to the KEV list on 2026-10-14.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203