Palo Alto Networks has patched CVE-2026-0322, a PAN-OS management interface flaw that lets an authenticated attacker with network access run code as root, and says it has seen very limited exploitation.
The company’s security advisory, published October 14, 2026, rates the flaw High with a CVSS score of 8.6 and its suggested urgency Highest. It applies to PAN-OS on PA-Series and VM-Series firewalls and on Panorama, both virtual and M-Series. Cloud NGFW and Prisma Access are not affected. The company says it found the issue internally.
The advisory states that “Very limited exploitation has been observed targeting the Palo Alto Networks management interface,” and lists three IP addresses tied to the attempts: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234. It says no workarounds exist. Fixed releases are available for PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 (12.2.4 and 10.2.18-h12, for example). The fixed 11.2.16 release carried an estimated date of October 15. Customers on older, unsupported versions are told to upgrade to a supported fixed version.
The company ties the risk to exposure. It says the danger is highest when the management interface accepts connections from external IP addresses on the Internet, and that restricting access to trusted internal addresses reduces the risk. Allowing only a jump box to reach it also lowers the risk. Threat Prevention subscribers can enable Threat IDs 510046 and 510047 from content version 9159-10287 and later, which the company calls limited coverage that needs SSL decryption of inbound management traffic and may miss variations of the attack.
In our reading, the advisory makes the management-plane address list the first control to audit. A firewall whose management interface answers on the Internet has an exposure that no signature fully covers, and the vendor’s own guidance puts upgrading ahead of the signatures. Another management plane came under attack in the Cisco SD-WAN Manager authentication bypass we covered earlier this month. Our opinion piece on replacing an exploited edge appliance sets out what to do when a device is hit.
