Vulnerability Report

CVE-2026-0322

RCE CISA KEV Active

Title: CVE-2026-0322

RCE

Proof Of Concept

PoC Available for CVE-2026-0322

CWE Category CWE-94

Published Date Oct 14, 2026

Modified Date Oct 15, 2026

Exploit Status Available

Score 8.6 CVSS v4.0

Exploit Probability (EPSS)

1.74%

Vulnerability Summary

CVE-2026-0322: A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

Impacted Vendors

paloaltonetworks 1

Reference Links

https://security.paloaltonetworks.com/CVE-2026-0322

CVSS v4.0

Source Entity [email protected]

Severity HIGH

8.6

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red

CVSS v3.1