CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Overview
PAN-OS contains a code injection flaw in its management interface that allows an authenticated attacker with network access to execute arbitrary code at the root level on affected firewalls. The flaw affects PA-Series and VM-Series firewalls and Panorama appliances running PAN-OS versions across the 10.2, 11.1, 11.2, 12.1, and 12.2 release lines. Cloud NGFW and Prisma Access are not affected. Palo Alto Networks rates this at its highest urgency, and very limited active exploitation has been observed.
Vulnerability details
CWE-94 (Improper Control of Generation of Code) describes a class of flaw where an application incorporates attacker-supplied input into dynamically generated or evaluated code without adequate sanitization. In PAN-OS, the management interface accepts input that is processed in a way that allows injected content to be interpreted as executable code rather than data. No special configuration is required for the interface to be vulnerable; the flaw is present in the default management interface across all affected release lines. The specific endpoint or parameter that accepts the malicious input has not been publicly disclosed.
An attacker who holds high-privilege credentials and has network access to the management interface can submit crafted input that the interface evaluates as code, resulting in arbitrary command execution with root privileges on the firewall. Full root access means the attacker can read or modify any configuration, extract credentials or certificates, install persistent backdoors, or disable security policy enforcement entirely. The precondition of high-privilege authentication materially limits opportunistic exploitation, but the flaw is actively being targeted, making credential hygiene and management interface exposure the primary risk variables.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review management interface authentication logs for successful logins from unexpected source IP addresses or at unusual times, particularly any session followed by anomalous configuration changes or process spawning that has no corresponding administrator activity.
- Audit firewall and Panorama management plane logs for unexpected process execution or file writes originating from the management interface process, which would indicate injected code has been evaluated rather than rejected.
- Verify that management interface access is restricted to a defined set of trusted internal IP addresses; any management interface reachable from external or uncontrolled IP ranges represents elevated exposure and should be treated as a priority for both patching and forensic review.
Remediation
Additional hardening
- Upgrade PAN-OS to the fixed release for your minor version: 12.2.4 or later, 12.1.10-h2 or later, 11.2.16 or later, 11.1.16-h3 or later, or 10.2.18-h12 or later. See the vendor advisory in References for the full per-minor-version boundary table.
- Restrict management interface access to a defined allowlist of trusted internal IP addresses. Palo Alto Networks explicitly states this is the primary compensating control; any management interface reachable from the internet carries the highest exploitation risk.
- Route management interface access through a dedicated jump host that is the sole permitted source, reducing the network attack surface even for authenticated users with valid credentials.
- Audit and rotate all high-privilege PAN-OS and Panorama administrator credentials, and review recent management interface session logs for signs of unauthorized access before and after patching.
Key dates
References
- https://security.paloaltonetworks.com/CVE-2026-0322
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-0322
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-0322
Frequently asked questions
Does CVE-2026-0322 affect my FedRAMP authorization?
If Palo Alto Networks PAN-OS runs inside your authorization boundary, yes. CVE-2026-0322 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of October 17, 2026 has already passed. An unpatched KEV inside a FedRAMP-authorized boundary is an assessor finding. An overdue one is visible to both your assessor and your sponsoring agency. At this point, you either close it out or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-0322?
Knox does not patch Palo Alto Networks PAN-OS on your behalf. Under the FedRAMP shared-responsibility model, remediating CVE-2026-0322 is your obligation. What Knox provides is the pre-authorized, single-tenant boundary in which you carry out that remediation, along with Knox's automated continuous monitoring platform and audit-artifact coverage to support documentation at your next assessment. Applying the fix is yours to own; maintaining a defensible compliance posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance issues, including CVE-2026-0322 class exposures. That means gaps surface during ongoing monitoring rather than waiting to be flagged at an assessor review, giving your team time to act before a finding becomes a formal conversation with your agency.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-0322's remediation deadline of October 17, 2026 has passed. What happens now?
If CVE-2026-0322 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is precisely what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding out now and documenting why the deadline was missed is what keeps your authorization standing and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
