Active Exploitation of Remote Code Execution Vulnerability in Palo Alto Network's PAN-OS
CVE-2026-0322 could allow an authenticated attacker to execute arbitrary code with root privileges on the firewall
Summary
CVE-2026-0322 could allow an authenticated attacker to execute arbitrary code with root privileges on the firewall
Affected platforms
The following platforms are known to be affected:
Threat details
Active Exploitation of CVE-2026-0322
Palo Alto Networks are reporting active exploitation of CVE-2026-0322 in the wild, and the US Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.
The NHS England National CSOC assesses further exploitation as highly likely.
Introduction
Palo Alto Networks has released a security advisory to address a high severity vulnerability in PAN-OS. Successful exploitation could allow an authenticated attacker with network access to execute arbitrary code with root privileges on an affected firewall.
- CVE‑2026‑0322 – 'Code Injection' vulnerability – CVSSv4 Score: 8.6
Remediation advice
Affected organisations are encouraged to review the CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface advisory and apply the relevant update as soon as possible.
Organisations are encouraged to restrict access to the management interface to only trusted internal IP addresses according to Palo Alto's recommended best practice deployment guidelines.
Definitive source of threat updates
Last edited: 15 October 2026 12:04 pm