CVE-2026-0322: PAN-OS code injection flaw exploited in the wild (advisory incomplete, vendor details not yet confirmed)
Published 26/10/2026 10:54
Timeline
3 events over 12 d
- 14/10/2026ConfirmedCISA Known Exploited Vulnerabilities+0 min
- 14/10/2026ExploitedCISA Known Exploited Vulnerabilities+12 d
- 26/10/2026 10:54Published on WatchtowerPro CISO
In short
CISA added CVE-2026-0322, a code injection flaw (CWE-94) in Palo Alto Networks PAN-OS, to its Known Exploited Vulnerabilities catalog on 14/10/2026. An authenticated attacker with network access could run code as root on the firewall. Fixed versions, affected versions and vendor workarounds are not yet confirmed, because the vendor advisory could not be checked.
Affected versions
- PAN-OS firewalls. The flaw is described as being in the management interface, and an authenticated attacker with network access could run code as root. Affected version ranges are not yet known.
- The main exposure question is who can reach the management interface; a valid login is needed (weak source, draft article).
What to do now
- Apply the Palo Alto Networks update for CVE-2026-0322. Exact fixed versions are not yet confirmed; check the vendor advisory before upgrading.
- Interim measures, which are not vendor guidance: restrict management interface access to a trusted internal network or jump host, and do not expose it to the internet.
- Interim measures reduce exposure and do not make a server safe. The flaw is already exploited, so they are not a substitute for updating.
- Review admin accounts and recent admin logins, and check for signs of compromise, since CISA requires forensic triage.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: 5 open questions, followed up as sources answer and all 3 sources with their dates. And technology matching: which of your systems run Palo Alto PAN-OS (GlobalProtect), at which version, fixed or not - and what each one needs.
Main sources
Known exploited: Palo Alto Networks PAN-OS - Palo Alto Networks PAN-OS Code Injection Vulnerability Vendor · Known Exploited Vulnerabilities Catalog Research · CISA Adds Four Known Exploited Vulnerabilities to Catalog Research