Vulnerabilities

PAN-OS CVE-2026-0322: root via the management interface

By Yaali. October 16, 2026, 6 min read, Vulnerabilities, Patching.

Palo Alto's exploited PAN-OS flaw gives a logged-in admin root on firewalls and Panorama. Fixed builds, how to lock down the MGT interface, and what to check.

Palo Alto Networks disclosed CVE-2026-0322 on October 14. It is a code injection flaw (CWE-94) in the PAN-OS management interface: an attacker who can reach that interface and log in can run arbitrary code as root. Palo Alto scores it 8.6 under CVSS version 4.0, rates its own suggested urgency as highest, and says "very limited exploitation" has already been seen. It affects PA-Series and VM-Series firewalls and Panorama, both virtual and M-Series. Cloud NGFW and Prisma Access are not affected, and no special configuration is needed for a vulnerable build to be exposed.

The US Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities (KEV) catalog the same day and gave federal civilian agencies until October 17 to fix it, three days after disclosure. If you run PAN-OS 10.2, 11.1, 11.2, 12.1 or 12.2 on any of the affected platforms, you need a fixed build this week, and you should check whether your management interface was reachable by anyone it should not be.

How it works

The management interface is the web console and API administrators use to configure the firewall, usually on the dedicated MGT port. Code injection means input that the interface should treat as data ends up being executed as code. Here that code runs as root, the most privileged account on the underlying operating system, which is far more than any PAN-OS administrator role is meant to allow. A root shell on a firewall can read stored secrets, change rules outside the normal config audit trail, and watch traffic.

Palo Alto has not published which request, page or parameter carries the injection. What the advisory does say is in the CVSS vector: network attack vector, low complexity, no user interaction, and high privileges required. In practice the attacker needs valid administrator credentials, which could come from a reused password, a phished admin, an account left over from a contractor, or a session hijacked some other way. That is why exposure of the interface matters so much. Palo Alto says the risk is greatest when the management interface is reachable from the internet, and reduced when access is limited to trusted internal addresses.

The flaw was found internally and is credited to Suraj Siddharudh of Palo Alto Networks.

What attackers are doing

Palo Alto's wording is "very limited exploitation" targeting the management interface. It has not named an actor, given a start date or described what attackers did after getting root. The advisory lists three IP addresses tied to the exploit attempts:

• 66.42.72[.]14
• 208.83.239[.]114
• 149.248.47[.]234

Use them as a starting point for a search. An attacker with valid credentials can come from any address, so no hits on these three does not mean you were not targeted.

What to do

1. Upgrade to a fixed build

Palo Alto ships hotfixes for older maintenance releases as well as a newer release per branch. Any of these closes the flaw:

Pick the hotfix that matches the maintenance release you run (for example 11.1.10 to 11.1.10-h35) or jump to the latest build on the branch. Early coverage gave 11.2.16 as due on October 15; Palo Alto updated the advisory that day to say it is published. Anything older than 10.2 is unsupported and gets no fix, so plan the move to a supported fixed release. Patch Panorama as well as the firewalls it manages.

2. Restrict the management interface today

Palo Alto says no workaround fully addresses the issue. Until every device is upgraded, cut down who can reach the console:

• In the PAN-OS web interface, go to Device > Setup > Interfaces, open Management, and add Permitted IP Addresses for your admin subnet or a single jump host. The list is empty by default, which allows any source. On Strata Cloud Manager the same field is under Device Setup > Management > Management Interface Settings.
• Keep the MGT port on a dedicated management network that users and the internet cannot route to.
• If a data-plane interface has a management profile with HTTPS or SSH enabled, remove it from any zone that faces the internet or general users.

Customers with a Threat Prevention subscription can enable Threat IDs 510046 and 510047 (Applications and Threats content 9159-10287 or later). Palo Alto calls this limited coverage that may miss variants. It only works when management traffic passes through a data-plane port with SSL decryption and Threat Prevention applied, so treat it as a stopgap until the upgrade is done.

3. Check whether you were already hit

• Search firewall, NetFlow and upstream proxy logs for the three advisory IPs, going back well before October 14.
• In Monitor > Logs > System, review administrator authentication events: logins from unfamiliar source addresses, at odd hours, or by accounts that rarely log in.
• In Monitor > Logs > Configuration, look for changes nobody on your team made, especially new administrator accounts, new authentication profiles or servers, changed permitted IP lists, and new NAT or security rules.
• Compare the administrator list under Device > Administrators with who should have access.

Root access can hide changes from these logs, so a clean result lowers the risk but does not clear the device. If you find anything, open a case with Palo Alto support before rebooting or reimaging, so evidence is kept.

4. Rotate credentials

The attack needs a valid login, so assume admin credentials on an exposed device are known. Reset local administrator passwords, remove accounts you cannot account for, and turn on multi-factor authentication for admin logins. On a device you suspect was compromised, also rotate what root could read: RADIUS and LDAP bind secrets, API keys, and certificates whose private keys live on the box.

Treat the management plane as its own network

This flaw is only reachable by someone who can talk to the management interface and has a password for it. A firewall console open to the internet, or to every user subnet, turns any leaked admin credential into a root shell on the device that enforces your network policy. Keeping management on a separate network, with a short permitted IP list and multi-factor logins, stops most of these bugs from mattering even before the patch lands.

Our safeguarding and hardening work reviews firewall management exposure and admin access, and a network penetration test shows which consoles are reachable from where. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: Palo Alto Networks advisory, The Hacker News, Help Net Security, SecurityWeek, SOC Prime, Qualys ThreatPROTECT, Palo Alto Networks docs: management interface settings, PAN-OS 10.2 web interface help: Device > Setup > Interfaces.