CVE-2026-0322 is an EITW post-auth RCE in PAN-OS management interface.
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
Very limited exploitation has been observed targeting the Palo Alto Networks management interface.
https://security.paloaltonetworks.com/CVE-2026-0322
:rainbowCrow:
npub1z3…cp45m
2026-10-14 16:29:52 UTC
Author Public Key
npub1z3sfut2znnrtgl0qt4q6npq8zmjd9c97ck0gh0me44ua6lzaaajq6cp45mSeen on
wss://relay.ditto.pubPublished at
2026-10-14 16:29:52 UTCEvent JSON
{
"id": "4c464d019850c6fa44d0a4174a171890f1d6cd59642fceda94957f7e56a8d4d4",
"pubkey": "14609e2d429cc6b47de05d41a9840716e4d2e0bec59e8bbf79ad79dd7c5def64",
"created_at": 1791995392,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/users/cR0w/statuses/117440210059394899",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "CVE-2026-0322 is an EITW post-auth RCE in PAN-OS management interface.\n\nA remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.\n\nThe security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCloud NGFW and Prisma® Access are not impacted by this vulnerability.\n\nVery limited exploitation has been observed targeting the Palo Alto Networks management interface.\n\nhttps://security.paloaltonetworks.com/CVE-2026-0322",
"sig": "b45c14e925f6e8e5e85db5edf452a877c233215539fe3858d5e09de30adbeaa6db573a9bb24893e342c718efe6ed458bfbb86616be3a2e17aef701949869c503"
}