CVE-2026-0322: RCE Vulnerability in Palo Alto Networks PAN-OS Management Interface

## Overview CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalog on October 14, 2026. This move signals a federal deadline for agencies to address the vulnerability. Evidence of exploitation has surfaced, prompting immediate action from defenders. ## Technical Details CVE-2026-0322 is a remote code execution (RCE) vulnerability found in the management interface of Palo Alto Networks PAN-OS software. An authenticated attacker with network access can exploit this flaw to execute arbitrary code with root privileges on affected firewalls. The vulnerability affects PAN-OS software running on PA-Series, VM-Series firewalls, and Panorama (both virtual and M-Series). Notably, Cloud NGFW and Prisma Access are not impacted by this issue. ## Impact The risk associated with CVE-2026-0322 is significant due to the potential for unauthorized code execution. Attackers could leverage this vulnerability to gain control over critical network infrastructure. The CVSS score of 8.6 indicates a high severity, underscoring the importance of prompt remediation. ## Mitigation To mitigate the risk posed by this vulnerability, organizations should restrict access to the management interface. Limit access to trusted internal IP addresses according to Palo Alto Networks’ best practice deployment guidelines. Regularly review and update firewall configurations to ensure compliance and reduce exposure to potential attacks.