PAN-OS management RCE exploited in the wild (CVE-2026-0322)

Actively exploited in the wild - CVE-2026-0322 is a high-severity remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series) that lets an authenticated attacker with network access execute arbitrary code with root privileges. Restrict management interface access to trusted internal IP addresses and apply the vendor fix immediately.

Overview

CVE-2026-0322 is a remote code execution flaw in the PAN-OS management interface. An attacker who can already authenticate to the management interface, and who has network reachability to it, can run arbitrary commands as root on the underlying firewall or Panorama appliance. The CVSS score is 8.6 (HIGH), with a network attack vector, low attack complexity, and no user interaction required.

The privileged access requirement does not make this bug harmless. Anyone holding valid management credentials, including a compromised admin account, a leaked API key, or a session stolen through phishing, gets full root-level control. In practice, attackers pair a credential foothold with this flaw to move from “logged in” to “owns the device” in a single step.

Affected platforms are PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted.

Impact

Because the flaw yields root, an attacker can read and modify firewall configuration, disable security policies, exfiltrate credentials and private keys, pivot into the internal network the firewall protects, and install persistent access. On a perimeter firewall, root compromise is effectively a network-wide incident, not a single-device one.

The vendor notes that risk is greatly minimized when the management interface is exposed only to trusted internal IP addresses, following their recommended deployment guidance.

Remediation and Mitigation

• Apply the PAN-OS update that addresses CVE-2026-0322 for your branch and platform. Check the vendor advisory for the exact fixed version and consult the Palo Alto Networks security advisory page.
• Restrict management interface access: allow only trusted internal IP addresses, and never expose the management plane to the public internet.
• Enforce multi-factor authentication on all administrative accounts, and audit for stale or shared credentials.
• Rotate firewall admin credentials and API keys if you suspect compromise, and review configuration and log data for unauthorized changes.

Security Insight

This is the second PAN-OS management-plane issue to draw active exploitation in 2026, following the GlobalProtect authentication bypass CVE-2026-0257, and it reinforces a pattern: attackers are targeting the management interface because it concentrates trust on the network’s most privileged appliance. Internet-exposed management planes remain the deciding factor, which is why restricting management access to trusted internal IPs continues to neutralize the practical risk here. Teams that treat the management interface as an internal control point, rather than another public service, will consistently come out ahead.

Further Reading

• Weekly Threat Roundup: Nx Console Supply Chain Attack (May 25-31)
• PAN-OS GlobalProtect exploit CVE-2026-0257 exploited
• Weekly Threat Roundup: Critical PAN-OS Flaw Exploited (May 4-10)
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs