---
title: Hunt: PAN-OS management CVE-2026-0322 (authenticated RCE) and vendor IoCs | ctxsec
url: https://ctxsec.com/items/hunt-panos-mgmt-0322
description: ""
status: "hunt idea"
published: 2026-10-14
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-panos-mgmt-0322.md)

hunt idea

2026-10-14

### Hunt: PAN-OS management CVE-2026-0322 (authenticated RCE) and vendor IoCs

Prioritize firewalls/Panorama whose management interface is reachable from untrusted networks. Correlate admin auth successes with odd CLI/API activity and outbound connections to the vendor-listed probe IPs: 66.42.72.14, 208.83.239.114, 149.248.47.234.

```
// KQL sketch (firewall / proxy logs ingested to Sentinel)
CommonSecurityLog
| where DeviceVendor has "Palo"
| where DestinationIP in ("66.42.72.14","208.83.239.114","149.248.47.234")
   or SourceIP in ("66.42.72.14","208.83.239.114","149.248.47.234")
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, RequestURL, Message
```

If Threat Prevention is licensed, confirm content ≥9159-10287 and IDs 510046/510047 are enabled (limited coverage; still patch). Sketch only.

Sources: [Palo Alto Networks CVE-2026-0322 (IoCs)](https://security.paloaltonetworks.com/CVE-2026-0322)