Skip to content
VulniPulse
Sign in
Advisory severityHighPalo Alto Networks Exploited CISA KEV Updated

High [CVE-2026-0322] PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

This high-severity Palo Alto Networks advisory covers CVE-2026-0322 affecting PAN-OS.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-0322 Source published

VulniPulse record published Record updated

CVE-2026-0322
Affected products & platforms
Palo Alto NetworksPAN-OSFirewallPAN-OS / Panorama
Open source advisory

Android app · Google Play

Monitor future Palo Alto Networks CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

CISA Known Exploited Vulnerability

Listed:
Oct 14, 2026 · federal remediation due Oct 17, 2026
Required action:
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions
  • PAN-OS 12.2: < 12.2.4
  • PAN-OS 12.1: < 12.1.4-h12< 12.1.7-h8< 12.1.10-h2
  • PAN-OS 11.2: < 11.2.4-h22< 11.2.7-h21< 11.2.10-h15< 11.2.13-h3< 11.2.16
  • PAN-OS 11.1: < 11.1.4-h37< 11.1.6-h39< 11.1.7-h11< 11.1.10-h35< 11.1.13-h15< 11.1.16-h3
  • PAN-OS 10.2: < 10.2.7-h38< 10.2.10-h41< 10.2.13-h26< 10.2.16-h11< 10.2.18-h12

Official advisory · high-confidence parse· fetched 19 hours ago·verify at source

Fixed versions
  • PAN-OS 12.2: >= 12.2.4
  • PAN-OS 12.1: >= 12.1.4-h12>= 12.1.7-h8>= 12.1.10-h2
  • PAN-OS 11.2: >= 11.2.4-h22>= 11.2.7-h21>= 11.2.10-h15>= 11.2.13-h3>= 11.2.16
  • PAN-OS 11.1: >= 11.1.4-h37>= 11.1.6-h39>= 11.1.7-h11>= 11.1.10-h35>= 11.1.13-h15>= 11.1.16-h3
  • PAN-OS 10.2: >= 10.2.7-h38>= 10.2.10-h41>= 10.2.13-h26>= 10.2.16-h11>= 10.2.18-h12

Official advisory · high-confidence parse· fetched 19 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • VersionMinor VersionSuggested SolutionCloud NGFWNo action needed.
  • PAN-OS 12.2 12.2.0 through 12.2.3 Upgrade to 12.2.4 or later.
  • PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h2 or later. 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h8 or 12.1.10-h2 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h12 or 12.1.10-h2 or later.
Temporary workarounds
  • No known workarounds exist for this issue.
  • Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510046 and 510047 (from Applications and Threats content version 9159-10287 and later).
  • For these Threat IDs to protect against attacks for this vulnerability:
  • Please note that this Threat ID requires SSL Decryption.

Official advisory · high-confidence parse· fetched 19 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.