PALO Alto Networks has disclosed CVE-2026-0322, a high-severity remote code execution flaw affecting PAN-OS managed devices, notably PA-Series, VM-Series and Panorama (virtual and M-Series). The vulnerability sits in the PAN-OS management interface and can be exploited by an authenticated attacker with network access to run arbitrary code with root privileges. Palo Alto’s advisory states exploitation has been observed in the wild, with the CVSS v4.0 score of 8.6.
The vendor warns that the risk is greatest when the management interface is reachable from external IPs on the internet, and notes that no public proof-of-concept exploit has been confirmed.
The affected products include PAN-OS versions across several branches: 12.2 (12.2.0–12.2.3), 12.1 (12.1.2–12.1.10-h1), 11.2 (11.2.0–11.2.15), 11.1 (11.1.0–11.1.16-h2), and 10.2 (10.2.0–10.2.18-h10), plus all older unsupported PAN-OS versions.
Workarounds are not available, so administrators should apply patched releases immediately: PAN-OS 12.2.4, 12.1.10-h2 (or 12.1.7-h8 / 12.1.4-h12), 11.2.16 (or 11.2.13-h3 / 11.2.10-h15 / 11.2.7-h21 / 11.2.4-h22), 11.1.16-h3 (or 11.1.13-h15 / 11.1.10-h35 / 11.1.7-h11 / 11.1.6-h39 / 11.1.4-h37), and 10.2.18-h12 (or 10.2.16-h11 / 10.2.13-h26 / 10.2.10-h41 / 10.2.7-h38).
Palo Alto also recommends tightening access to the management interface, and, for Threat Prevention subscribers, enabling Threat IDs 510046 and 510047 (content version 9159-10287 or later) when SSL decryption is in use on management traffic routed via a data plane port.