---
title: Authenticated Remote Code Execution in the Palo Alto Networks PAN-OS Management Interface
description: Palo Alto Networks has disclosed a high-severity code injection vulnerability in the management interface of its PAN-OS network security operating system that allows an authenticated attacker with network access to execute arbitrary code with root privileges on the affected device.
---

[Advisories | 1898 & Co.](https://1898advisories.burnsmcd.com)

# [Authenticated Remote Code Execution in the Palo Alto Networks PAN-OS Management Interface](https://1898advisories.burnsmcd.com/authenticated-remote-code-execution-in-the-palo-alto-networks-pan-os-management-interface)

 Written by [The 1898 & Co. Team](https://1898advisories.burnsmcd.com/author/1898-co-team) | October 19, 2026

#### Security Advisory Brief

Palo Alto Networks has disclosed a high-severity code injection vulnerability in the management interface of its PAN-OS network security operating system that allows an authenticated attacker with network access to execute arbitrary code with root privileges on the affected device. Tracked as CVE-2026-0322 and carrying a CVSS v4.0 base score of 8.6, the flaw affects PAN-OS running on PA-Series and VM-Series firewalls as well as Panorama management appliances in both virtual and M-Series form factors. Palo Alto Networks assigned the issue its highest suggested urgency and released fixed software across every supported release branch on October 14, 2026.

The vulnerability stems from improper control over how the management interface generates and processes code (CWE-94). An attacker who already holds valid administrative credentials and can reach the management plane over the network can inject commands that run outside the intended administrative boundary, ultimately gaining root-level execution on the firewall or management appliance itself. Because the flaw yields full control of the device enforcing an organization's network segmentation and inspection policy, a successful attack converts the security control into an attacker foothold. No unusual configuration is required for a device to be vulnerable.

Critically, Palo Alto Networks has confirmed that exploitation is already occurring. The advisory states that very limited exploitation has been observed targeting the management interface, placing the vulnerability in an actively attacked state rather than a theoretical one. While the vendor notes that the attack is not readily automatable and requires prior authentication, the combination of root-level impact, confirmed in-the-wild activity, and the sensitive position firewalls and Panorama occupy in a network makes prompt remediation essential for every organization operating affected PAN-OS software.

#### Threats and Vulnerabilities

CVE-2026-0322, with a CVSS v4.0 base score of 8.6, is a code injection vulnerability in the PAN-OS management interface that enables an authenticated, network-adjacent attacker to achieve arbitrary code execution with root privileges. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), and its CVSS vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) reflects a network attack vector, low attack complexity, and high confidentiality, integrity, and availability impact, offset by the requirement for high privileges. Palo Alto Networks additionally calculated an adjacent-network variant of the score at 8.5, applicable to scenarios where management access is routed through a jump box, indicating that limiting access to a jump host reduces but does not eliminate exposure. Palo Alto Networks published a CVSS v4.0 score but did not issue a CVSS v3.1 score for this advisory. The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama virtual and M-Series appliances; Cloud NGFW and Prisma Access are not affected. Palo Alto Networks has confirmed very limited observed exploitation in the wild, and the issue carries the vendor's highest suggested urgency.

#### Client Impact

The operational impact of this vulnerability is severe because it targets the device that enforces an organization's perimeter and internal segmentation policy. An attacker who gains root execution on a firewall or Panorama appliance can disable or modify security policy, inspect or redirect traffic, harvest credentials and configuration secrets, pivot deeper into the network, and establish persistence on a platform that defenders rarely image or rebuild. For organizations that rely on PAN-OS firewalls to separate corporate IT from operational technology environments, compromise of the management plane removes a key boundary control and can expose industrial networks that depend on that segmentation. Although exploitation requires valid administrative credentials, credential theft, phishing, and reused passwords are common precursors, and the confirmed in-the-wild activity means the barrier to a working attack chain is lower than the privilege requirement alone suggests.

From a compliance and governance standpoint, firewalls and centralized management consoles are frequently designated as critical cyber assets under regulatory frameworks such as NERC CIP, IEC 62443, and NIST SP 800-53, where management-interface integrity and prompt patching of known-exploited flaws are explicitly required. An unpatched, internet- or widely-reachable management interface running vulnerable PAN-OS software represents a demonstrable control gap that auditors and regulators are likely to scrutinize, particularly given the vendor's confirmation of active exploitation. Organizations subject to incident-reporting obligations should also account for the possibility that a management-plane compromise would trigger notification requirements.

#### Mitigations

Organizations operating affected PAN-OS software should take the following actions to reduce exposure to CVE-2026-0322:

1. Upgrade PAN-OS to a fixed release for the applicable branch as the primary remediation: 12.2.4 or later for the 12.2 branch; 12.1.4-h12, 12.1.7-h8, or 12.1.10-h2 for 12.1; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, or 11.2.16 for 11.2; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, or 11.1.16-h3 for 11.1; and 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, or 10.2.18-h12 for 10.2. Devices running older, unsupported PAN-OS versions have no fix and must be upgraded to a supported fixed release.
2. Restrict access to the management interface to a small set of trusted internal IP addresses or a single dedicated jump box, and remove any direct exposure of the management interface to untrusted or internet-facing networks; note that this reduces risk but does not fully eliminate it.
3. For organizations with a Threat Prevention subscription, enable Threat IDs 510046 and 510047 using content version 9159-10287 or later to obtain limited detection coverage; this measure requires SSL Decryption to be enabled so the firewall can inspect the relevant traffic.
4. Apply additional management-plane hardening by routing management (MGT) port traffic through a data-plane interface, replacing the inbound management certificate, and decrypting inbound management traffic so the device can inspect it.
5. Review authentication logs and management-interface access records for anomalous administrative activity, and investigate connections involving the vendor-reported source addresses 66.42.72.14, 208.83.239.114, and 149.248.47.234; rotate administrative credentials and inspect for unauthorized configuration changes on any device suspected of compromise.

Because no software workaround fully removes the vulnerability, upgrading to a fixed release remains the only complete remediation, and the access restrictions and detection content above should be treated as interim risk-reduction measures rather than substitutes for patching.

#### 1898 & Co. Response

1898 & Co. actively monitors vulnerability disclosures and threat activity affecting the network security platforms that protect both enterprise IT and operational technology environments, including Palo Alto Networks PAN-OS firewalls and Panorama management systems. Our team reviews actively exploited vulnerabilities such as CVE-2026-0322 as they emerge and translates vendor advisories into actionable guidance tailored to each client's deployment and risk profile.

Our security professionals have supported organizations across critical infrastructure sectors in assessing exposure to management-interface vulnerabilities, hardening administrative access paths, and validating that firewalls and management appliances are patched against known-exploited flaws. We work alongside clients to prioritize remediation based on reachability, privilege requirements, and the role each device plays in enforcing segmentation between corporate and industrial networks.

For organizations that wish to confirm whether this vulnerability has been exploited in their environment, 1898 & Co. offers threat hunting and incident response services that examine management-plane access, authentication activity, and configuration integrity against the indicators and behaviors associated with this class of attack. Our analysts can help validate patch deployment, assess the security posture of exposed management interfaces, and support investigation where compromise is suspected.

#### Sources

1. [Palo Alto Networks Security Advisory — CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface](https://security.paloaltonetworks.com/CVE-2026-0322)
2. [NVD Entry — CVE-2026-0322](https://nvd.nist.gov/vuln/detail/CVE-2026-0322)

[View full post](https://1898advisories.burnsmcd.com/authenticated-remote-code-execution-in-the-palo-alto-networks-pan-os-management-interface)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The 1898 & Co. Team"
  },
  "dateModified" : "2026-10-19T15:26:03.217Z",
  "datePublished" : "2026-10-19T15:26:02Z",
  "headline" : "Authenticated Remote Code Execution in the Palo Alto Networks PAN-OS Management Interface",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://1898advisories.burnsmcd.com/authenticated-remote-code-execution-in-the-palo-alto-networks-pan-os-management-interface",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Advisories | 1898 & Co."
  }
}
```