- Palo Alto Networks says CVE-2026-0322, a PAN-OS management interface flaw, lets an attacker with high privileges run code as root. It has seen very limited exploitation.
- Palo Alto says risk is highest when the interface is open to the internet. It lists no workarounds, and Threat Prevention coverage is limited.
- Confirm no management interface faces the internet, check PAN-OS versions against the advisory, and apply the fixes.
A firewall decides who gets in. It also has a door of its own: the management interface, where administrators change the rules. A flaw in that door is a different problem from a flaw in an app behind the wall.
Palo Alto Networks has now published such a flaw. CVE-2026-0322 is a remote code execution bug in the management interface of PAN-OS, the software that runs its firewalls. The company says it has seen very limited exploitation. The lesson here is that a severity score is only half of the risk. The other half is who can reach the interface.
What Palo Alto reported
The advisory describes an attacker who is logged in with high privileges and can reach the interface over the network. That attacker can run any code they choose, with root rights. Root is the top level of control on the device.
The affected products are PA-Series and VM-Series firewalls, plus Panorama in virtual and M-Series forms. Panorama is the console that manages many firewalls at once. Two Palo Alto products, Cloud NGFW and Prisma Access, are outside the scope. The advisory adds that no special setup is needed for a device to be affected.
Palo Alto says it has seen "very limited exploitation" of the management interface. It names three IP addresses tied to threat activity and limited exploit attempts. BleepingComputer reports that CISA has added the flaw to its Known Exploited Vulnerabilities catalog.
How the flaw works
Palo Alto classes the bug as CWE-94, improper control of code generation. People often call this code injection. In plain terms, the interface can be tricked into treating attacker input as commands. Palo Alto says a successful attack runs the injected code as root.
The bar to start is not low. The scoring vectors in the advisory both carry PR:H, which means high privileges are required. In practice that points to an administrator-level account, not any ordinary login. BleepingComputer adds that attackers need existing credentials and network access.
Palo Alto still ties the risk to exposure. It scores the flaw 8.6 when the interface can be reached from the internet. It scores it 8.5 when access runs through one jump box. A jump box is a hardened system that is the only one allowed to connect.
The two scores sit close together. The real gap is in how many people can even try.
A high bar is not a closed door
High privileges make this harder to exploit than a flaw anyone can trigger. That is a real point in the defender's favour.
But admin credentials do leak, get reused and get phished. If the login page also faces the internet, anyone holding one such credential has a direct path to root. The case for closing that path is simple. Credentials plus an internet-reachable interface is a pairing you can remove.
Palo Alto's own guidance agrees. It says the risk is minimized when access to the interface is restricted to trusted internal IP addresses.
Important questions remain open. BleepingComputer asked Palo Alto when the attacks began and who is behind them. It also asked whether attackers took over firewalls or used them to reach internal networks. The material we reviewed does not answer these.
So we do not know how attackers got their access. A firewall sits between the internet and the internal network, so control of one is a strong position. That is why this deserves more than routine patching.
Patching helps, but it is not the whole plan
BleepingComputer reports that patched builds now cover five PAN-OS branches, from 10.2 up to 12.2. The build for 11.2.16 was due on October 15. Anyone running an older, unsupported release needs to move to a supported one first.
The advisory lists no known workarounds. Customers with a Threat Prevention subscription can switch on Threat IDs 510046 and 510047. This gives partial cover. The signatures only work if inbound traffic is decrypted.
Palo Alto is frank about the gap. The signatures catch attack patterns it already knows. Variations may slip past them. Its advice is to upgrade if the flaw and the exposure apply to you.
That deadline binds federal civilian agencies only. Private firms set their own. It does show how CISA rates the urgency.
Questions to put to your security team
First, can anyone on the internet reach the management interface of any firewall or Panorama console we run? Ask for proof, not an assumption.
Second, if access is limited, is it limited to a jump box or to trusted internal addresses, as Palo Alto recommends?
Third, which PAN-OS version does each device run, and is it on the affected list? Ask for a dated inventory.
Fourth, have the three listed IP addresses appeared in management logs? If so, treat the device as possibly compromised and ask who is reviewing it.
Fifth, who holds administrator credentials for these interfaces, and when were they last reviewed?
Patching closes this flaw. Narrowing who can reach the admin page limits the next one. A security device is only as protected as its own door.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Palo Alto Networks.
