Palo Alto Networks disclosed a code-injection RCE in the PAN-OS management interface (CVSS 8.6) that lets an authenticated attacker with network access run code as root on PA-Series, VM-Series, and Panorama. Cloud NGFW and Prisma Access are not affected. Vendor status: "Very limited exploitation has been observed." Urgency highest when management is reachable from the internet. Patches landed Oct 14 across 10.2 / 11.1 / 11.2 / 12.1 / 12.2 trains (see advisory for exact hotfix lines; 11.2.16 ETA Oct 15). Threat Prevention IDs 510046/510047 (content 9159-10287+) give limited coverage if MGT traffic is routed through a DP port with decrypt. Vendor IoCs: 66.42.72.14, 208.83.239.114, 149.248.47.234. CISA added it to KEV the same day (due Oct 17).