CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability

Vulnerability summary

CVE-2026-0322 is a high (CVSS 8.6) Code Injection vulnerability in Palo Alto Networks PAN-OS. It is known to be exploited: CISA lists it, first on 14-10-2026. EPSS estimates a 1.21% chance of exploitation in the next 30 days, higher than 68% of scored vulnerabilities.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Added to CISA KEVPalo Alto Networks PAN-OS Code Injection Vulnerability
3. 15-10-2026
   Last modifiedVulnerability information updated.
4. 17-10-2026
   CISA remediation dueApply mitigations per vendor instructions.

Description

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.