CVE-2026-0322: PAN-OS Management Interface Authenticated RCE
CVE-2026-0322 is a high-severity remote code execution vulnerability in the PAN-OS management interface. An authenticated attacker with network access to the interface can execute arbitrary code with root privileges on a vulnerable firewall. Exploitation has been observed in the wild. Patch affected devices immediately and restrict management access to trusted internal hosts.
Impacted systems
| Software / application | Version / scope |
|---|---|
| PAN-OS 12.2 (PA-Series, VM-Series, Panorama) | Affected: before 12.2.4 · Fixed: 12.2.4 |
| PAN-OS 12.1 (PA-Series, VM-Series, Panorama) | Affected: any build older than the fixed hotfix for your 12.1.x line · Fixed: 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2 |
| PAN-OS 11.2 (PA-Series, VM-Series, Panorama) | Affected: any build older than the fixed hotfix for your 11.2.x line · Fixed: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16 |
| PAN-OS 11.1 (PA-Series, VM-Series, Panorama) | Affected: any build older than the fixed hotfix for your 11.1.x line · Fixed: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3 |
| PAN-OS 10.2 (PA-Series, VM-Series, Panorama) | Affected: any build older than the fixed hotfix for your 10.2.x line · Fixed: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, or 10.2.18-h12 |
| Cloud NGFW and Prisma Access | Not affected |
Exploitation conditions
The management interface must be reachable over the network, and the attacker must be authenticated with sufficient privileges. Exploitation allows arbitrary code execution as root on the firewall. Exploitation has been observed, with limited attempts reported against management interfaces. Exposure is greatest when management access is available from untrusted or internet-facing networks.
Recommended action
- Upgrade each affected firewall and Panorama appliance to a fixed PAN-OS version listed in the vendor advisory.
- Immediately restrict management interface access to trusted internal IP addresses. Where possible, permit access only from a dedicated, controlled jump host.
- If a Threat Prevention subscription is available, enable Threat IDs 510046 and 510047 with Applications and Threats content version 9159-10287 or later. Coverage is limited and requires routing management traffic through a data-plane interface, replacing the inbound management certificate, decrypting inbound management traffic, and enabling Threat Prevention inspection.
- Review management access logs and network telemetry for suspicious access attempts, unexpected administrative activity, or anomalous changes. Prioritise internet-exposed management interfaces.
- Investigate suspicious devices for compromise. Preserve evidence and follow your incident response process before making changes. Rotate credentials and secrets if compromise is suspected.
Workarounds
Restrict management interface access to trusted internal IP addresses or a dedicated jump host while arranging the upgrade. This reduces exposure but does not replace patching.
Threat Prevention signatures 510046 and 510047 provide limited coverage only when the vendor's required traffic routing and SSL decryption conditions are met. Do not treat signatures as a substitute for upgrading.
Indicators of compromise
IP Addresses
66.42.72.14
208.83.239.114
149.248.47.234
Threat Prevention Signature
510046
510047