CISA Warns of Palo Alto Networks PAN-OS Code Injection Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency has added a high-severity Palo Alto Networks PAN-OS vulnerability to its Known Exploited Vulnerabilities catalog after confirming it is being used in real-world attacks.

The flaw, tracked as CVE-2026-0322, affects the PAN-OS management interface and could let an authenticated attacker run arbitrary code with root-level access on a vulnerable firewall.

Palo Alto Networks published its security advisory on October 14, describing the issue as an authenticated remote code execution vulnerability.

The company assigned the flaw a CVSS 4.0 score of 8.6 and marked its urgency as highest. While exploitation requires valid credentials and network access to the management interface, a successful compromise could give an intruder deep control over a security device that sits at the edge of an organization’s network.

The vulnerability is classified as CWE-94, also known as improper control of code generation or code injection. In simple terms, the weakness can let an attacker supply input the system treats as executable code.

Because the affected component is the firewall management interface, the risk increases significantly when that interface is reachable from untrusted or internet-facing systems. Palo Alto Networks said it has seen very limited exploitation attempts targeting the interface.

PAN-OS Code Injection Vulnerability Exploited

CISA added CVE-2026-0322 to the KEV catalog on October 14 and set an October 17 deadline for U.S. federal civilian agencies to apply mitigation measures.

The agency also marked the flaw for forensic triage under Binding Operational Directive 26-04. This means affected organizations should not treat patching as the only task. Security teams should also check whether their devices show signs of unauthorized access before and after remediation.

The issue affects PAN-OS running on PA-Series and VM-Series firewalls, as well as Panorama virtual appliances and M-Series appliances. Palo Alto Networks says Cloud NGFW and Prisma Access are not affected.

Organizations should identify all PAN-OS management systems, confirm their running versions, and compare them with the vendor’s fixed releases. For PAN-OS 12.2, the recommended upgrade is version 12.2.4 or later. Customers on unsupported PAN-OS releases should move to a supported fixed version.

Palo Alto Networks has released fixes across the PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 branches. The exact safe release depends on the maintenance line in use.

For example, users on PAN-OS 11.2.14 through 11.2.15 should upgrade to 11.2.16 or later. Administrators should carefully review the official Palo Alto Networks advisory before planning upgrades, especially where high-availability firewall pairs and Panorama-managed devices are involved.

No complete workaround exists for CVE-2026-0322. Palo Alto Networks advises customers to restrict management interface access to trusted internal IP addresses, ideally through a hardened jump box.

Internet exposure of firewall administration portals should be removed wherever possible. Teams using Threat Prevention can enable Threat IDs 510046 and 510047. However, the vendor describes this coverage as limited and says it requires SSL decryption for inbound management traffic.

The vendor also shared three IP addresses linked to limited exploit attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114, and 149[.]248[.]47[.]234.

Security teams should review firewall, VPN, authentication, and management-plane logs for activity involving these addresses. They should also investigate unfamiliar administrator accounts, unexpected configuration changes, failed and successful logins, and suspicious outbound connections from firewall management systems.

This latest warning adds to the growing number of PAN-OS security issues that defenders must track. Readers can also review Cyber Security News coverage of a previous PAN-OS command injection vulnerability and an earlier CISA PAN-OS KEV alert for broader context on protecting Palo Alto Networks environments.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.