A Palo Alto firewall login is enough to own the firewall. Upgrade PAN-OS and lock down the admin page

Palo Alto Networks published a fix on Wednesday for a bug in the PAN-OS management interface that lets an attacker who has admin access run code as root on the firewall. The company says it has seen “very limited exploitation.”

The attacker needs a login first, which is why the score is 8.6 and not higher. Palo Alto still rates the urgency as its highest level, and CISA put it on the exploited list the same day.

Someone who already has a firewall admin password can use this bug to own the firewall itself. Check who can reach that login page.
The 5-Minute Cyber Brief
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Email address
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.

Palo Alto sees limited attacks on a PAN-OS admin bug

The bug, CVE-2026-0322, is a code injection in the PAN-OS web management interface. Palo Alto’s advisory says it “enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.” It was found internally by a Palo Alto researcher.

Palo Alto lists three IP addresses tied to “threat activity and limited exploit attempts”: 66.42.72[.]14, 208.83.239[.]114 and 149.248.47[.]234. It says no workaround exists.

PA-Series, VM-Series and Panorama with reachable admin pages

The bug affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama, virtual and M-Series, on the 10.2, 11.1, 11.2, 12.1 and 12.2 lines. No special configuration is needed. Cloud NGFW and Prisma Access are not affected.

Palo Alto says the risk is highest when the management interface accepts connections from the internet. An attacker with a phished or reused admin password, or a former contractor’s account that was never removed, has a direct path to root.

Upgrade PAN-OS and lock the admin page to a jump box

Upgrade to the fixed release for your line, for example 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 or 10.2.18-h12. Palo Alto’s advisory lists the hotfix for each minor version. Its table gives 11.2.16 an ETA of October 15, so 11.2 users who need the fix now can take the hotfix for their minor version.
Restrict management access to a jump box or trusted internal addresses. Palo Alto scores the bug lower (8.5) with that in place.
Search firewall and Panorama logs for the three IP addresses above.
Review the admin account list and remove accounts nobody can vouch for.

Forward this

For whoever runs our Palo Alto firewalls: there is a new PAN-OS bug, already used in limited attacks, that lets anyone with an admin login run code as root on the firewall or Panorama. Can we upgrade this week, confirm the admin page is only reachable from our jump box, and check the logs for the three IP addresses Palo Alto published?

Details

CVE-2026-0322: PAN-OS management interface code injection (CWE-94), CVSS-B 8.6 (8.5 with jump-box-only access), urgency HIGHEST, exploit maturity ATTACKED. Published October 14, 2026.
Fixed: 12.2.4; 12.1.4-h12, 12.1.7-h8, 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3; 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12.
Threat Prevention: Threat IDs 510046 and 510047 (content 9159-10287 and later) give limited coverage, and only if management traffic is routed through a data-plane interface and decrypted.
KEV: added October 14, 2026; federal due date October 17, 2026.

Hunt / verify

Management-interface logins from 66.42.72[.]14, 208.83.239[.]114 or 149.248.47[.]234.
Admin sessions from addresses outside your jump hosts, and configuration commits nobody scheduled.
New admin accounts or changed admin roles on firewalls and Panorama since October 1.

Slack paste: PAN-OS CVE-2026-0322: authenticated mgmt-interface RCE as root, limited exploitation. Action: upgrade (12.2.4 / 12.1.10-h2 / 11.2.16 / 11.1.16-h3 / 10.2.18-h12 or listed hotfix), jump-box-only admin access, search logs for 66.42.72.14, 208.83.239.114, 149.248.47.234. CISA due Oct 17.

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].