CVE-2026-0322: listed in the CISA KEV catalog

CVE-2026-0322 · KEV 2026-10-14 · patch available

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Is CVE-2026-0322 exploited?

Listed in the CISA KEV catalog on 2026-10-14.
Federal remediation due 2026-10-17.
Public exploit code: none found in monitored sources.

Which products and versions are affected?

Palo Alto Networks · PAN-OS · 10.2 <10.2.10-h41
Palo Alto Networks · PAN-OS · 11.1 <11.1.7-h11
Palo Alto Networks · PAN-OS · 11.1 <11.1.6-h39
Palo Alto Networks · PAN-OS · 11.1 <11.1.4-h37
Palo Alto Networks · PAN-OS · 10.2 <10.2.7-h38
Palo Alto Networks · PAN-OS · 12.1 <12.1.10-h2
Palo Alto Networks · PAN-OS · 11.2 <11.2.16
Palo Alto Networks · PAN-OS · 11.1 <11.1.16-h3
Palo Alto Networks · PAN-OS · 12.1 <12.1.4-h12
Palo Alto Networks · PAN-OS · 12.2 <12.2.4
Palo Alto Networks · PAN-OS · 11.2 <11.2.7-h21
Palo Alto Networks · PAN-OS · 10.2 <10.2.18-h12
Palo Alto Networks · PAN-OS · 11.2 <11.2.4-h22
Palo Alto Networks · PAN-OS · 11.1 <11.1.13-h15
Palo Alto Networks · PAN-OS · 11.1 <11.1.10-h35
Palo Alto Networks · PAN-OS · 12.1 <12.1.7-h8
Palo Alto Networks · PAN-OS · 11.2 <11.2.15
Palo Alto Networks · PAN-OS · 11.2 <11.2.13-h3
Palo Alto Networks · PAN-OS · 10.2 <10.2.13-h26
Palo Alto Networks · PAN-OS · 11.2 <11.2.10-h15

Is there a patch?

PAN-OS 10.2 10.2.10-h41
PAN-OS 11.1 11.1.7-h11
PAN-OS 11.1 11.1.6-h39
PAN-OS 11.1 11.1.4-h37
PAN-OS 10.2 10.2.7-h38
PAN-OS 12.1 12.1.10-h2
PAN-OS 11.2 11.2.16
PAN-OS 11.1 11.1.16-h3
PAN-OS 12.1 12.1.4-h12
PAN-OS 12.2 12.2.4
PAN-OS 11.2 11.2.7-h21
PAN-OS 10.2 10.2.18-h12
PAN-OS 11.2 11.2.4-h22
PAN-OS 11.1 11.1.13-h15
PAN-OS 11.1 11.1.10-h35
PAN-OS 12.1 12.1.7-h8
PAN-OS 11.2 11.2.15
PAN-OS 11.2 11.2.13-h3
PAN-OS 10.2 10.2.13-h26
PAN-OS 11.2 11.2.10-h15

What PlainSec published about CVE-2026-0322

CISA puts firewall, mail, and backup flaws on clock (2026-10-15)

Primary sources

What this record does not say

No CVSS score from NVD.
No EPSS score.

KEV and EPSS are re-checked daily. Record last updated 2026-10-15.