Palo Alto PAN-OS: code injection as root, exploited

📌 Later developments: PAN-OS zero-day CVE-2026-0322: fixed versions and IoCs (October 14, 2026)

On 14 October 2026 CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalog. It is a vulnerability in the management interface of Palo Alto Networks PAN-OS. According to the description published in the NVD entry, an authenticated attacker with network access to the interface can execute arbitrary code with root privileges on the firewall. Palo Alto Networks rates the severity as high: CVSS 4.0 8.6.

Inclusion in the KEV catalog means CISA has evidence of active exploitation. At the time of writing only one source is available, the CISA advisory with the linked NVD entry: all the details below come from there.

What happened

CISA added CVE-2026-0322 to KEV with the description “Palo Alto Networks PAN-OS Code Injection Vulnerability” and set 17 October 2026 as the deadline for US federal agencies: three days. In the catalog, use in ransomware campaigns is marked as “unknown”.

The advisory asks to apply mitigations according to the vendor’s instructions, in line with the BOD 26-04 directive on prioritising updates based on risk and with CISA’s forensic triage requirements. For cloud services the guidance of the same directive applies; if mitigations are not available, the product should be discontinued. The advisory also asks to assess the internet exposure of every system.

Neither CISA nor the NVD entry provides details on the attacks observed, the attackers, the victims or how the attackers obtained authenticated access.

Technical details

• CVE: CVE-2026-0322, published on 14 October 2026. The NVD entry is in “Received” status: NIST has not yet carried out its analysis.
• Affected products: PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
• Products not affected: according to the description, Cloud NGFW and Prisma Access are not impacted.
• Component: the PAN-OS management interface.
• Condition: the attacker must be authenticated and have network access to the management interface.
• Effect: arbitrary code execution with root privileges on the device.
• Weakness: CWE-94 (Code Injection), meaning the system can be made to interpret and run code supplied by the attacker.
• Severity: CVSS 4.0 8.6 (high), score provided by Palo Alto Networks. The vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H indicates a network attack of low complexity, with no user interaction, but requiring high privileges; the impact on the device’s confidentiality, integrity and availability is high. In the vector Palo Alto also sets E:A (exploitation observed) and U:Red, the highest level of the vendor urgency metric.
• Versions: the available sources do not list affected or fixed versions. The reference is the Palo Alto Networks advisory on CVE-2026-0322, listed among the references of the NVD entry.
• Indicators of compromise: none published in the sources.
• Attack chain: the sources do not describe it, so MITRE ATT&CK techniques cannot be mapped with certainty.

The official description states that the risk is greatly reduced by restricting access to the management interface to trusted internal IP addresses only, following the deployment guidelines recommended by Palo Alto Networks.

Impact for European and Italian companies

The firewall is the point through which traffic passes between the corporate network and the internet, and often between internal segments as well. An attacker with root privileges on the firewall, or on a Panorama console managing many of them, can change policies and configuration across the whole perimeter.

The authentication requirement narrows who can exploit the vulnerability, but CISA confirms that exploitation is already under way. Companies whose management interface can be reached from untrusted networks, or from the internet, are the most exposed: this is precisely the situation the description says to avoid.

For NIS2 entities the vulnerability falls under vulnerability management, with documented priorities and timelines; if the firewalls are managed by a provider, the check must be done with them. A significant incident must be notified to the national CSIRT, which in Italy is CSIRT Italia at ACN. If a firewall compromise exposes personal data, it must also be assessed as a breach under the GDPR, with notification to the supervisory authority within 72 hours where required. In healthcare, where the firewall often separates clinical networks from administrative ones, the check should be done without delay.

What to do now

1. Take an inventory of PA-Series and VM-Series firewalls and Panorama consoles, including those managed by providers, with the PAN-OS version of each.
2. Restrict access to the management interface to trusted internal IP addresses only, as the official description indicates, and verify that it is not reachable from the internet.
3. Follow Palo Alto Networks’ instructions: use the advisory on CVE-2026-0322 for fixed versions and any mitigations.
4. If you cannot act right away: as CISA asks, if mitigations are not available consider taking the device out of service.
5. Review administrative access: since an authenticated user is required, check which accounts can access the management interface, which addresses they connected from and whether there are unexpected logins.
6. Look for signs of exploitation: updating is not enough. Check for unplanned configuration changes, new administrative accounts, unusual processes and outbound connections from the device; use the verification procedures provided by Palo Alto Networks, if available.
7. If you find signs of compromise: preserve logs and evidence for forensic analysis before reinstalling, then change the administrative credentials and the keys and certificates configured on the device.

How ARXDOME helps

ARX Expose checks the services your company exposes on the internet, open ports, recognised products and their known vulnerabilities: a way to find out whether a management interface can be reached from outside. ARX Sentry collects firewall logs in a central collector, so logins and changes stay recorded even outside the device, and it has dedicated firewall pages showing firmware status. ARX Horizon enriches events with threat lists and vulnerability information.

Last updated: 14 October 2026