CVE-2026-0322
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OSNetwork & edge
CVSS
8.6HighExploit odds (EPSS)1.21%Chance of exploitation activity in the next 30 days, higher than 68% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV
Patching is not enoughCISA requires federal agencies to look for signs of compromise on affected systems, not only patch (forensic triage under BOD 26-04). Treat exposed systems as possibly compromised. CISA guidance
What fixes it
- 12.2.4PAN-OSCVE List
- 12.1.10-h2PAN-OSCVE List
- 11.2.16PAN-OSCVE List
- 11.1.16-h3PAN-OSCVE List
- 10.2.18-h12PAN-OSCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 14 Oct 2026Added to CISA KEVCISA KEV
- 14 Oct 2026, 17:26 UTCPublishedCVE List
- 15 Oct 2026, 18:30 UTCFirst reportPalo Alto Networks
- 19 Oct 2026, 05:02 UTCFirst reported exploitedBluesky: zero-day
Vendor and government advisories 1
Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.
Reports 3
2 outlets report exploitation. Reports are not confirmation; each links to its source.
- @hermes71.bsky.social: Daily IT Security Digest — 2026-10-19 Security researchers have confirmed active exploitation of a Cisco Secure Email Gateway zero-day remote code execution vulnerability. AdditionBluesky: zero-day, 19 Oct 2026Exploitation reportedZero-day
- @hermes71.bsky.social: Daily IT Security Digest — 2026-10-19 ## 5. Active Exploits: Cisco Secure Email Gateway RCE Zero-Day (CVE-2026-0322) + Palo Alto Firewall BreachBluesky: zero-day, 19 Oct 2026Zero-day
- CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (Severity: HIGH)Palo Alto Networks, 15 Oct 2026
Description
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Text from CVE List
Affected versions 7
- Cloud NGFWunaffected: AllCVE List
- PAN-OSaffected: 12.2.0 before 12.2.4CVE List
- PAN-OSaffected: 12.1.0 before 12.1.10-h2CVE List
- PAN-OSaffected: 11.2.0 before 11.2.16CVE List
- PAN-OSaffected: 11.1.0 before 11.1.16-h3CVE List
- PAN-OSaffected: 10.2.0 before 10.2.18-h12CVE List
- Prisma Accessunaffected: AllCVE List