High 8.6Being exploited
Palo Alto Networks · PAN-OS · CVE-2026-0322
PAN-OS firewalls can be taken over through the management interface
A flaw in the PAN-OS management interface lets an attacker who can log in and reach it over the network run code as root on the firewall. Palo Alto has seen very limited exploitation and says no workaround exists. The risk is much lower where the management interface is reachable only from trusted internal addresses.
- Affected
- PA-Series and VM-Series firewalls and Panorama on PAN-OS 12.2.0 to 12.2.3, 12.1.2 to 12.1.10, 11.2.0 to 11.2.15, 11.1.0 to 11.1.16 and 10.2.0 to 10.2.18 (including hotfix builds), plus unsupported older versions. Cloud NGFW and Prisma Access are not affected.
- What to do
- Upgrade to 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 or 10.2.18-h12 or later (Palo Alto also lists earlier hotfix builds on each branch). Restrict the management interface to trusted internal IPs or a jump box, and never expose it to the internet.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
- Why it’s here
- Exploited (in limited attacks); on CISA's KEV list; Palo Alto firewalls are widely used by businesses of every size.