CVE-2026-0322 CISA KEV · Actively exploited

PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface

CVSS score

8.6

EPSS probability

—

Risk score

1.7

Published

13 h ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Mitigation available

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

CVE AI research

The stored explanation is shown at once; refreshing evaluates the sources again.

DayBreach AI Explanation

Verified against sources

Palo Alto Networks PAN-OS Management Interface Authenticated RCE Vulnerability

Sources read

Source agreement

Tam uyum

Evidence confidence

%71

Short explanation

A remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS software allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. This issue is actively exploited in the wild.

Why does it matter?

It presents a critical security risk because it allows authenticated attackers to execute code with root privileges on firewalls and is actively exploited.

What should be done?

Apply mitigations in accordance with vendor instructions
Restrict management interface access to trusted internal IP addresses
Follow BOD 26-04 and related security update guidelines

Chain of evidence and sources2 verified claims

Palo Alto Networks PAN-OS yönetim arayüzündeki zafiyet, kimliği doğrulanmış bir saldırganın root yetkileri ile uzaktan kod çalıştırmasına izin verir.

S0 · daybreach-canonical S1 · cvelist S2 · nvd S3 · kev

Bu zafiyet CISA KEV kataloğunda yer almakta olup aktif istismar edilmektedir.

S0 · daybreach-canonical S3 · kev

Show the technical text from the sources

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red

CWE: CWE-94

Explanation produced with the local gemini-flash-lite-latest model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2026-0322 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

ID	VENDOR	PRODUCT	ACTION
1	Palo Alto Networks	Cloud NGFW	View
2	Palo Alto Networks	PAN-OS	View
3	Palo Alto Networks	Prisma Access	View
4	Palo Alto Networks	PAN-OS	View

Total affected vendors: 1|Products: 4

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCORE	VERSION	SEVERITY	VECTOR	SOURCE
8.6	CVSS V4_0	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red	CVE CNA
8.6	CVSS V40	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red	NVD
8.5	CVSS V4_0	HIGH	CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red	CVE CNA

Patch and Remediation Guide

Solution & Remediation Advisory

Workaround

Resmî yama doğrulanamadı; geçici azaltım veya workaround mevcut.

canonical

Confirm the affected product and version against the source evidence above.

Restrict access to internet-facing services and apply network segmentation.

Until a patch is confirmed, follow the vendor advisory; do not read an unknown status as “no patch”.

Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

This CVE is marked as actively exploited in the CISA KEV catalogue, but no verified, downloadable public PoC or Metasploit module has been found yet. Evidence of active exploitation does not mean that public exploit code exists.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-0322 is associated with the following CWEs:

CWE-94: Improper Control of Generation of Code ('Code Injection')

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-0322 weaknesses.

CAPEC-66: SQL Injection CAPEC-126: Path Traversal CAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden

PermissionsHigh

UserGerekmiyor

Official Sources and Advisories

https://security.paloaltonetworks.com/CVE-2026-0322vendor-advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322nvd CISA Known Exploited Vulnerabilities Catalogkev

CVSS Vector Radar Chart

8.6 / 10

Vulnerability Scoring Details

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredHigh privileges

User InteractionNone required

Confidentiality (Gizlilik)Low

Integrity (Bütünlük)None

Availability (Erişilebilirlik)High

Geçici çözüm

Resmî yama doğrulanamadı; geçici azaltım veya workaround mevcut.

Follow the vendor

Palo Alto Networks

Weakness Type (CWE & CAPEC)

CWE-94

Similar Vulnerabilities

9.3

CVE-2024-0012 Actively exploited

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

VendorPalo Alto NetworksProductCloud NGFW+4 etkilenen

Patch status unknown Public Exploits:11EPSS %1001 y ago

9.1

CVE-2025-0108 Actively exploited

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal