Habla con un experto
PreciosNoticiasHabla con un experto
Volver a la sala de prensa
Amenazas

PAN-OS Management Interface Flaw CVE-2026-0322 Exploited in the Wild

Palo Alto Networks has patched an authenticated root-level RCE in the PAN-OS management interface that is already seeing limited exploitation, and CISA has added it to KEV. Here is who is affected and what to do now.

4T4Tify Team4Tify
Oct 15, 2026·4 min de lectura
PAN-OS Management Interface Flaw CVE-2026-0322 Exploited in the Wild

PAN-OS Management Interface Flaw Under Active Attack: Patch CVE-2026-0322 Now

Palo Alto Networks has released fixes for CVE-2026-0322, a high-severity remote code execution bug in the PAN-OS management interface. The vendor confirms the flaw is already being exploited, although only on a small scale so far. CISA has since added it to its Known Exploited Vulnerabilities (KEV) catalog, alongside a critical Cisco Secure Email Gateway bug.

What happened

  • The flaw: CVE-2026-0322 (CVSS 8.6) lets an attacker who has network access to the management interface and valid credentials run arbitrary code as root on the firewall.
  • Affected: PAN-OS on PA-Series and VM-Series firewalls, and on Panorama (virtual and M-Series).
  • Not affected: Cloud NGFW and Prisma Access.
  • Exploitation: Palo Alto Networks reports "very limited" exploitation against management interfaces. It has not said who is behind it, what the attackers are after, or when the activity started. Three US-geolocated IP addresses are linked to the attempts: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234.
  • No special setup needed: a default configuration is enough to be exploitable if the management interface can be reached.

The same KEV update includes CVE-2026-76519 (CVSS 9.8) in Cisco Secure Email Gateway. A crafted email attachment, processed while file reputation is enabled, can let an unauthenticated attacker write files and run commands as root. US federal civilian agencies must fix both flaws by 17 October 2026.

Why it matters

The attacker needs credentials, but that is less of a barrier than it sounds. Management credentials get phished, reused, left at defaults, or turn up in infostealer logs. Once someone has them, this bug turns admin access into root on the device that enforces your perimeter. From there they can change policy, intercept traffic, plant persistence and move into the internal network. Firewall management planes have been a favourite target for several years, and a CVE that is both on the KEV list and confirmed exploited belongs at the top of the patch queue.

What to do

  1. Patch now. Fixed releases include PAN-OS 12.2.4+, 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2+, 11.2.4-h22 / 11.2.7-h21 / 11.2.10-h15 / 11.2.13-h3 (11.2.16 is due 15 October 2026), 11.1.4-h37 / 11.1.6-h39 / 11.1.7-h11 / 11.1.10-h35 / 11.1.13-h15 / 11.1.16-h3, and 10.2.7-h38 / 10.2.10-h41 / 10.2.13-h26 / 10.2.16-h11 / 10.2.18-h12. Check the vendor advisory for your exact train.
  2. Lock down the management interface. It should never be reachable from the internet. Allow only trusted internal IPs, ideally a single hardened jump host.
  3. Rotate and harden admin credentials. Enforce MFA for administrative access and remove stale or shared accounts.
  4. Hunt for compromise. Look in management and system logs for connections from the IPs listed above, unexpected admin logins, and configuration changes you can't explain.
  5. Check Cisco Secure Email Gateway too if you run it, and apply Cisco's fix for CVE-2026-76519.

Not sure whether your firewall's management plane is visible from outside? 4Tify's external attack-surface assessment finds exposed admin interfaces before attackers do.

Originally reported by The Hacker News. Vendor advisory: Palo Alto Networks — CVE-2026-0322.

COMPARTIR