The NVD record for CVE-2026-0322, the PAN-OS code injection bug CISA put in its KEV catalog on 14 October 2026, carries two scores from two sources. Palo Alto Networks scored it 8.6 on CVSS 4.0. NVD scored it 7.2 on CVSS 3.1. Neither is wrong, and reading the vector string shows why they differ.
The record was published on 14 October 2026 and last modified on 15 October, with status Analyzed.
What's affected
Everything below comes from one API call to NVD's CVE API 2.0. The record holds a cvssMetricV40 entry (source: psirt@paloaltonetworks.com, type Secondary) and a cvssMetricV31 entry (source: nvd@nist.gov, type Primary).
How to check if you're exposed
Pull the scores:
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-0322" \
| jq '.vulnerabilities[0].cve.metrics
| {v40: .cvssMetricV40[0].cvssData | {baseScore, baseSeverity, vectorString},
v31: .cvssMetricV31[0].cvssData | {baseScore, baseSeverity, vectorString}}'
The CVSS 4.0 vector in this record starts like this:
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/...
Decode the base part:
- AV:N attack vector is network. AC:L attack complexity is low.
- AT:N no special attack requirements. This metric is new in 4.0.
- PR:H the attacker needs high privileges, meaning an authenticated account.
- UI:N no user interaction.
- VC:H, VI:H, VA:H high impact on confidentiality, integrity and availability of the vulnerable system.
- SC:N, SI:N, SA:N no impact on other systems. CVSS 4.0 scores subsequent systems separately, replacing the 3.1 Scope metric.
- E:A exploit maturity is Attacked. This is a threat metric, and it matches the KEV listing.
The supplemental metrics are in the same record as plain fields: Automatable NO, Recovery USER, value density DIFFUSE, response effort MODERATE and provider urgency RED. They do not change the base score.
What to do now
- Record the vector string, not only the number. The number hides which assumptions were made.
- Note the source. A vendor score is the vendor's view of its own product, NVD's is a second opinion.
- Check PR:H against your environment. Here the management interface being reachable only from trusted networks changes your real risk, which the CVE text itself recommends.
- Do not rank by CVSS alone. This CVE scores 8.6 yet is in KEV, and a bug at 9.8 with no exploitation is not more urgent.
Why it matters
Dashboards often show one number and drop the vector. When two scores disagree, the vector is the only way to see whether the difference comes from the version of CVSS, the scorer, or the threat metrics.
Quick check
What does PR:H mean in this vector?
The attacker needs high privileges before exploiting the bug, which here means an authenticated account on the firewall management interface.
