CVE-2026-0322: Actively Exploited Vulnerability

CVE-2026-0322 Advisory

Vulnerability: Remote Code Execution in Palo Alto Networks PAN-OS Management Interface

Affected Products:

• PAN-OS on PA-Series firewalls
• PAN-OS on VM-Series firewalls
• Panorama (virtual and M-Series)

Not Affected:

• Cloud NGFW
• Prisma Access

Severity: CVSS score not yet assigned

KEV Status: Known to be exploited (CISA KEV catalog)

Impact: Authenticated attacker with network access to management interface can execute arbitrary code with root privileges.

Remediation:

• Apply vendor security updates when available
• Restrict management interface access to trusted internal IP addresses per Palo Alto Networks best practice guidelines: https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431

References:

• https://security.paloaltonetworks.com/CVE-2026-0322
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog