Source: ThreatAft

CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalog on 14 October 2026, alongside flaws in Cisco Secure Email Gateway and Ahsay backup software. The vulnerability is a code injection flaw in the management interface of Palo Alto Networks PAN-OS, rated CVSS 4.0 8.6. An attacker who already has valid credentials and network access to the management interface can execute arbitrary code with root privileges on the firewall itself. Palo Alto Networks has confirmed very limited exploitation in the wild.

Who is affected

The flaw affects PA-Series hardware firewalls, VM-Series virtual firewalls and Panorama management appliances, both virtual and M-Series. Cloud NGFW and Prisma Access are not affected. Patched versions are available across the PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 branches. Palo Alto Networks states that no known workaround eliminates the vulnerability, and its Threat Prevention signatures provide only limited protection, which makes patching and restricting management interface access the two priorities.

Why the credential requirement is not a comfort

The attack path requires valid credentials, but that is rarely a real barrier. Phishing, password reuse and credential harvesting mean most organisations should assume an attacker could hold credentials for an internet-exposed management interface. A compromised firewall is an especially valuable prize, because it sits at the network perimeter and can observe or redirect traffic. European companies running self-managed PAN-OS firewalls should patch during the next maintenance window and verify that management interfaces are not reachable from the internet.

If you need help auditing your firewall estate, verifying patch levels and closing exposed management interfaces, contact Excello Digital at https://excello.digital/contact/. We help European businesses harden their perimeter before attackers find the gaps.