TL;DR: An authenticated attacker with network access to the PAN-OS management interface can run code as root. Severity is HIGH, but urgency is HIGHEST and exploit maturity is ATTACKED. It's in KEV. (PAN, KEV) It doesn't meet the CVSS 9+ bar; it's included because it's exploited.
| Item | Detail | Source |
|---|---|---|
| CVE / severity | CVE-2026-0322, CVSS 4.0 8.6 HIGH (CWE-94) | PAN |
| Exploitation | "Very limited exploitation has been observed" | PAN |
| KEV | dateAdded 2026-10-14, dueDate 2026-10-17 | KEV |
| Affected | PA-Series, VM-Series, Panorama. Cloud NGFW and Prisma Access are not affected | PAN |
| Fixed (examples) | 12.2.4; 12.1.10-h2; 11.2.16 (published 10-15); 11.1.16-h3; 10.2.18-h12. The advisory has the full hotfix matrix | PAN |
| Workaround | None. Threat IDs 510046/510047 give limited coverage and require SSL decryption. Restrict management to trusted IPs | PAN |
Post-install impact
No confirmed breakage found in the vendor advisory.
Last verified 2026-10-15Report an error: [email protected]