ZeroDayAlert

CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability

Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

Palo Alto Networks PAN-OS Added to KEV 2026-10-14 Federal due 2026-10-17 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Palo Alto Networks PAN-OS firewalls running on any deployment model are affected. The vulnerability allows an authenticated attacker with network access to inject and execute arbitrary code with root privileges. The record does not specify which versions of PAN-OS are vulnerable, nor does it identify a released patch version.

How to check whether this touches you

  • Inventory your firewalls: identify all PAN-OS instances in your estate, including virtual, cloud-based, and appliance deployments.
  • Establish reachability: confirm which of these firewalls accept authenticated connections from untrusted networks or user accounts (administrative access, API endpoints, or integrated management interfaces).
  • Check running version: use show system info on the CLI or the web UI System Information page to determine the installed PAN-OS version; version alone does not confirm vulnerability status, as patches may be backported, but it informs your next step.
  • Consult vendor advisory: visit Palo Alto Networks' security advisories for CVE-2026-0322 to establish the affected version range and availability of patches for your deployment.

What to do

  1. Immediate access control: restrict authentication to PAN-OS management interfaces (CLI, web UI, API) to defined trusted networks only; disable or enforce stronger authentication on any unnecessary administrative accounts.
  2. Monitor for patches: track Palo Alto Networks' official CVE-2026-0322 advisory for patch availability and BOD 26-04 compliance timelines; document your patch readiness plan.
  3. Plan remediation in order of exposure: prioritise patching or mitigation of firewalls that accept authenticated connections from less-trusted segments first.
  4. Enable logging: ensure all administrative actions, API calls, and authentication attempts are logged with sufficient retention to support post-incident forensics (align with CISA's Forensics Triage Requirements referenced in the record).
  5. Escalate if patching is unavailable: if mitigations or patches remain unavailable within your compliance window, escalate to security leadership and asset owners to evaluate discontinuation or alternative controls per BOD 26-04 guidance.

If you find you were exposed

Exploitation of this vulnerability requires prior authentication, so review logs for successful logins to PAN-OS management interfaces and any API activity during the period before disclosure. Search firewall logs and syslog archives for unusual administrative commands, code execution attempts, or privilege escalation; log retention limits will constrain how far back you can look. If you cannot access logs for the relevant period, document the gap and work with your forensics team to establish whether filesystem or cloud-provider audit logs can fill it. Flag any suspicious activity for incident response investigation, particularly if it coincides with unauthorised firewall configuration changes or outbound traffic anomalies.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-0322 is being exploited. It cannot tell you whether PAN-OS is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →