CVE-2026-0322 is a code injection flaw in the PAN-OS management interface that gives an authenticated attacker root on the firewall. The record scores it 7.2 (High); the vendor scores it 8.6. It is on the CISA Known Exploited Vulnerabilities list. Upgrade to a fixed release and restrict management access.
What's affected
The weakness is CWE-94 (code injection). It applies to PAN-OS on PA-Series and VM-Series firewalls and on Panorama, virtual and M-Series. Cloud NGFW and Prisma Access are not impacted. No special configuration is required to be affected.
Fixed releases from the vendor advisory:
- PAN-OS 12.2: upgrade to 12.2.4 or later.
- PAN-OS 12.1: 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2 or later, depending on your point release.
- PAN-OS 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 or 11.2.16 or later.
- PAN-OS 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 or 11.1.16-h3 or later.
- PAN-OS 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12 or later.
- Older unsupported versions: move to a supported fixed version.
Pick the fixed build that matches your current minor version, as the vendor's solution table maps each range to its fix. For example, 11.2.8 through 11.2.10 should go to 11.2.10-h15 or 11.2.16 or later.
Severity differs by source. The record carries CVSS 3.1 7.2 (High) with high privileges required. The vendor advisory lists CVSS-BT 8.6 on CVSS 4.0, with the exploit maturity marked as attacked, and a suggested urgency of Highest. The vendor describes the exploitation it has seen as very limited, aimed at the management interface.
How to check if you're exposed
Start with the version. On each firewall or Panorama, run the following from the command line and compare the result to the fixed list above.
show system info | match sw-version
Then check where the management interface listens and who can reach it. The vendor says risk is highest when management access is allowed from external IP addresses on the internet. Review the permitted IP list on the management profile, the management port exposure on any internet facing interface, and firewall rules in front of the management network.
Look at administrator accounts and recent configuration or login activity for anything you do not recognise. If a management interface was reachable from the internet at any point, treat that period as one to review.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Identify every PAN-OS firewall and Panorama appliance, with version and management exposure.
- Upgrade to the fixed release for your minor version from the list above. The vendor recommends remediating as soon as possible.
- Restrict management interface access to trusted internal addresses. The vendor suggests a jump box as the only system allowed to reach it. It lists no other workaround.
- Remove management access from internet facing interfaces if it is enabled.
- Review administrator accounts, logins and configuration changes on exposed devices for activity you cannot explain.
- Track the CISA KEV entry linked below, since federal agencies follow its remediation deadlines and many others use it as a priority signal.
Why it matters
A management interface is the control surface for the device that guards your network. Code execution as root there means the attacker can change rules, read traffic handling settings and use the firewall as a foothold. The attacker needs valid credentials first, which is why the vendor rates the privilege requirement as high, but stolen or reused admin credentials are common.
The record marks this CVE as known exploited, and it appears in the CISA Known Exploited Vulnerabilities catalog. The vendor's advisory also says very limited exploitation has been observed against the management interface. This is the reason to treat it as urgent despite the 7.2 base score in the record.
The lasting lesson is the one the vendor gives in its own text: management interfaces belong on trusted internal networks, behind a jump box.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-0322 exploited in the wild?
Yes, according to the record, which flags it as known exploited, and the vendor, which reports very limited exploitation targeting the management interface. The CISA catalog entry is linked in the sources.
Does it need credentials?
Yes. The record describes an authenticated attacker with network access. That is why limiting who can reach the management interface reduces risk, though it is not a substitute for the update.
Sources
Last reviewed: 18 October 2026.
