---
title: PAN-OS CVE-2026-0322: authenticated management-interface RCE as root; limited attacks observed, on CISA KEV | ctxsec
url: https://ctxsec.com/items/panos-cve-2026-0322
description: ""
status: "confirmed (vendor + CISA KEV), limited exploitation"
published: 2026-10-14
---

> 

[← Cybersecurity News](/news) · [markdown](/items/panos-cve-2026-0322.md)

confirmed (vendor + CISA KEV), limited exploitation

2026-10-14

### PAN-OS CVE-2026-0322: authenticated management-interface RCE as root; limited attacks observed, on CISA KEV

Palo Alto Networks disclosed a code-injection RCE in the PAN-OS management interface (CVSS 8.6) that lets an authenticated attacker with network access run code as root on PA-Series, VM-Series, and Panorama. Cloud NGFW and Prisma Access are not affected. Vendor status: "Very limited exploitation has been observed." Urgency highest when management is reachable from the internet. Patches landed Oct 14 across 10.2 / 11.1 / 11.2 / 12.1 / 12.2 trains (see advisory for exact hotfix lines; 11.2.16 ETA Oct 15). Threat Prevention IDs 510046/510047 (content 9159-10287+) give limited coverage if MGT traffic is routed through a DP port with decrypt. Vendor IoCs: 66.42.72.14, 208.83.239.114, 149.248.47.234. CISA added it to KEV the same day (due Oct 17).

Sources: [Palo Alto Networks CVE-2026-0322](https://security.paloaltonetworks.com/CVE-2026-0322) · [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)