CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection
Authenticated attackers can execute arbitrary code with root privileges on PAN-OS firewalls via the management interface.
- Exploited in the wild
- Since 14 Oct 2026
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-0322?
CVE-2026-0322 is a high-severity code injection vulnerability in Paloaltonetworks Pan-Os, published on 14 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2026-0322?
It affects 1 product.
Products include Paloaltonetworks Pan-Os.
How do I fix CVE-2026-0322?
No fix has been published for CVE-2026-0322 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Oct 2026.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-0322 being exploited?
Yes. Attackers have exploited CVE-2026-0322 in the wild since at least 14 Oct 2026.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Paloaltonetworks Pan-Os
- CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection
- CVE-2020-2021 Palo Alto Networks PAN-OS Authentication Bypass
- CVE-2017-15944 Palo Alto Networks PAN-OS Remote Code Execution
- CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write
- CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass
Sources
Also known as GHSA-9fh3-97mp-7wmv.