CISA adds Palo Alto PAN-OS CVE-2026-0322 to KEV catalog

CISA added CVE-2026-0322, a Palo Alto Networks PAN-OS flaw, to its Known Exploited Vulnerabilities catalog on October 14, 2026.

The flaw allows root code execution. The code injection bug in the PAN-OS management interface lets an authenticated attacker with network access run arbitrary code with root privileges on the firewall. It affects PA-Series and VM-Series firewalls and Panorama; Cloud NGFW and Prisma Access are not affected.

Palo Alto has seen limited attacks. The company says it has observed very limited exploitation targeting the management interface and rates the flaw 8.6 under CVSS 4.0. Risk is highest when the management interface is reachable from the internet, and Palo Alto recommends restricting access to trusted internal IP addresses.

Fixed releases are available. Palo Alto lists fixes across PAN-OS 10.2 through 12.2, including 12.2.4 and 11.2.16 or later.

Federal agencies have until October 17. CISA set the due date three days after the catalog addition. Under BOD 26-04, agencies must apply vendor mitigations and follow CISA's forensic triage requirements, or stop using the product if mitigations are unavailable.