Actively exploited PAN-OS management flaw CVE-2026-0322 hits CISA KEV catalog

PAN-OS management interface flaw lands on CISA's exploited-vulnerability list

On October 14, 2026, Palo Alto Networks disclosed CVE-2026-0322, a flaw in the PAN-OS management interface that lets an attacker who already holds a valid administrator credential and can reach that interface execute arbitrary code with root privileges on the firewall. According to a dev.to write-up of the disclosure, CISA placed the bug on its Known Exploited Vulnerabilities (KEV) catalog the same day and gave US federal civilian agencies until October 17 to remediate — a three-day window tied to Palo Alto's observation of a small number of real-world exploitation attempts.

What the vulnerability requires

The dev.to post, relaying Palo Alto's advisory, reports a CVSS score of 8.6 and a CWE-94 classification, meaning attacker-supplied input gets executed as a command rather than treated as data. Two preconditions apply: a valid administrative credential and network access to the management interface. No device configuration makes an appliance vulnerable or safe on its own, and the advisory names no workaround beyond upgrading or restricting access to the interface.

Suraj Siddharudh, a senior principal product security researcher at Palo Alto Networks, found the issue internally, and the company has not attributed the observed attacks to a named group. The advisory lists three IP addresses — 66.42.72.14, 208.83.239.114 and 149.248.47.234 — connected to the detected activity.

Why the authentication requirement is no comfort

The dev.to author's central argument is that the "authenticated" label is the riskiest part of this advisory. Firewall admin credentials leak through infostealer malware, password reuse and compromised endpoints just like any other credentials, so an attacker holding a stolen account effectively gets root access regardless of what the CVSS vector says about required privileges.

Restricting management access to a dedicated jump host barely changes the scored severity, dropping it from 8.6 to 8.5, because anyone with valid credentials who reaches that host can still exploit the flaw. Threat Prevention signatures 510046 and 510047 cover known attack patterns, but the advisory reportedly warns that variations may escape detection, making the signatures partial coverage rather than a fix.

Fixed builds and recommended checks

According to the post, the minimum fixed PAN-OS builds are 10.2.18-h12, 11.1.16-h3, 11.2.16, 12.1.10-h2 and 12.2.4, depending on the branch deployed. PA-Series, VM-Series and Panorama installations are in scope, while Cloud NGFW and Prisma Access were never affected.

Beyond patching, the author recommends that operators confirm the management interface is reachable only from a dedicated jump host even on patched branches, review firewall and Panorama admin logs for activity from the three published IP addresses, and rotate any credential that touched the management interface from an unexpected network. The author's own audit, described in the post, uncovered a leftover VM-Series instance from an early pilot reachable from a general office network rather than the intended jump host — exactly the kind of drift that confirmed exploitation makes expensive.

Why it matters

Two things lift this above a routine patch item. First, the threat is demonstrated, not hypothetical: CISA's same-day KEV listing and the compressed federal deadline exist because attackers have already paired valid credentials with this flaw against live firewalls. Second, the bug illustrates a recurring weakness in how teams read severity scores. A CVSS "privileges required" field describes what the vulnerability demands, not how difficult those privileges are to acquire in a specific environment. Organizations that install the fixed build and move on may still be one stolen admin password away from compromise, and no PAN-OS release can close that particular gap.