> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # CVE-2026-0322 Palo Alto Networks PAN-OS: Palo Alto Networks PAN-OS Code Injection Vulnerability - URL: https://f4n6.co.uk/security-feed/cve-2026-0322-palo-alto-networks-pan-os-palo-alto-networks-pan-os-code-injection-vulnerability/ - Published: 2026-10-14T21:01:12.000Z - Updated: 2026-10-14T21:01:12.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-0322 ## 1\. Executive summary Palo Alto Networks PAN-OS contains a code injection vulnerability, CVE-2026-0322, rated CVSS 8.6 HIGH, that allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The flaw is not in CISA KEV as of this advisory, and the source material records no confirmed exploitation in the wild. The exposure is concentrated in internet-facing PAN-OS management and dataplane interfaces, where root-level code execution on the firewall places the device itself and any trust relationship it brokers (VPN, segmentation, inspection) at risk. For EMEA financial services clients running PAN-OS at the network edge, the practical concern is that a compromised firewall is a position from which downstream controls can be bypassed, not merely a single failed host. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 24 | The vulnerability is in an ICT system used to provide a financial service and requires a testing and remediation response | Digital operational resilience testing programmes should include this class of edge appliance; remediation evidence feeds the testing record | | DORA Art. 28 | PAN-OS is an ICT third-party product supplied by Palo Alto Networks, and the fix depends on vendor instructions | Third-party risk management must capture the vendor advisory, the patch availability, and the contractual path to remediation | | NIS2 Art. 21(2)(d) | The affected component is a network security appliance in the supply chain | Supply chain security measures should cover the appliance vendor's patch cadence and your own deployment inventory | No DORA Art. 17, 18, 19, 29 or 30 obligation and no NIS2 Art. 23 or UK NIS 2018 duty is directly engaged by this item on the facts available: the source records no confirmed incident, no major incident, and no concentration or contractual trigger specific to this CVE. ## 3\. Technical analysis & attack chain The source material for CVE-2026-0322 is thin. NVD describes a code injection vulnerability in PAN-OS that allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. No exploited component, no affected version list, no proof-of-concept, and no observed exploitation are given in the provided sources. The following chain reflects only what the source supports. 1. The attacker requires authenticated access and network reachability to the affected PAN-OS interface. The source does not specify which interface, which authentication realm, or which role is sufficient. 2. The attacker supplies input that the vulnerable component fails to neutralise, resulting in code injection (CWE-94). 3. The injected code executes with root privileges on the firewall. Everything beyond step 3 (persistence, command-and-control, lateral movement, data access) is not described in the source and is not asserted here. The verified reference data records CWE-94 (Code Injection) for this CVE; no conflicting classification appears in the source, so no discrepancy note is required. The related sources in this corpus concern a different CVE, CVE-2026-0257, a PAN-OS GlobalProtect authentication bypass that is in CISA KEV with a 2026-06-01 due date. Those sources are relevant as context for the same product family and the same operational pattern (internet-facing PAN-OS, rapid exploitation after disclosure), but they do not describe CVE-2026-0322 and must not be read as evidence about it. The CVE-2026-0257 material is single-sourced to Unit 42 for the exploitation indicators and multi-sourced across SecurityWeek, The Register, The Hacker News and BleepingComputer for the exploitation fact itself; the Rapid7 observation of exploitation from at least 2026-05-17 is reported by The Register and is single-sourced to Rapid7\. Treat the CVE-2026-0257 detail as context only. No threat actor is named in the source for CVE-2026-0322, and the verified reference data contains no MITRE ATT&CK profile for any actor in connection with this CVE. Any attribution would be unconfirmed and is not made here. ## 4\. Mitigation & containment P1 (within 24 hours) - Inventory every PAN-OS instance and confirm which are reachable from untrusted networks. The source does not give an affected version range, so treat all deployed versions as candidates until the vendor advisory is checked. - Apply the vendor mitigation in accordance with Palo Alto Networks instructions. The source names no specific fixed version; obtain the fixed release from the vendor advisory before scheduling. - Restrict management and any exposed PAN-OS interface to trusted administrative networks. The vulnerability requires network access and authentication, so reducing reachability removes the precondition. - Where the vendor fix is not yet available for a given release, follow the source's stated fallback: discontinue use of the product for that function if mitigations are unavailable. P2 (within 72 hours) - Review PAN-OS authentication logs for successful logins from unexpected source addresses or accounts, and for administrative actions that do not match change records. The source gives no specific log fields, so scope this to your normal administrative audit trail. - Confirm that the firewall's role in VPN termination, segmentation and inspection is documented, so that the blast radius of a root-level compromise is known before it happens. P3 (within 7 days) - Fold PAN-OS into the edge appliance patch cycle with a defined maximum exposure window, and record the vendor advisory reference against each asset. - Re-test the compensating controls (management plane isolation, administrative MFA, egress filtering from the appliance) that would limit an attacker who reaches step 3 of the chain. The source references CISA BOD 26-04 and CISA "Forensics Triage Requirements" as the required-action framework and gives a due date of 2026-10-17\. Those are US federal directives; they are cited here as the source's stated framework, not as an obligation on EMEA clients. ## 5\. Indicators of compromise No indicators of compromise available in the source material. The source describes no hashes, domains, IP addresses, file paths, registry keys or command lines for CVE-2026-0322\. The related CVE-2026-0257 sources describe exploitation behaviour (unauthorized VPN sessions, forged authentication override cookies) but give no atomic indicators in the provided text, and those indicators would in any case belong to a different CVE. No behavioural indicator table is provided for CVE-2026-0322 because the source describes no observable behaviour specific to it. ## 6\. Detection Insufficient indicators to author detection rules. The source material for CVE-2026-0322 contains no distinctive strings, command-line flags, mutex names, scheduled-task or service names, file names or paths, registry keys, or hard-coded values. A rule built on the CVE identifier or the product name would detect reporting about the vulnerability, not the vulnerability itself, and is not emitted. ## CVE assessment 1 referenced CVE | CVE | CVSS | Exploited | EPSS | Summary | | ------------------------------------------------------------------------------ | -------- | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-0322](https://nvd.nist.gov/vuln/detail/CVE-2026-0322?ref=f4n6.co.uk) | 8.6 High | — | — | A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authe… | ## 7\. Sources - NVD, CVE-2026-0322 detail, https://nvd.nist.gov/vuln/detail/CVE-2026-0322, published 2026-10-13 - NVD, CVE-2026-0257 detail (CISA KEV), https://nvd.nist.gov/vuln/detail/CVE-2026-0257 - Palo Alto Unit 42, Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257, https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/ - SecurityWeek, Recent Palo Alto Networks Vulnerability Exploited for Weeks, https://www.securityweek.com/recent-palo-alto-networks-vulnerability-exploited-for-weeks/ - The Register, Palo Alto VPN bug graduates from advisory to active exploitation, https://www.theregister.com/cyber-crime/2026/06/01/palo-alto-vpn-bug-graduates-from-advisory-to-active-exploitation/5249114 - The Hacker News, PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation, https://thehackernews.com/2026/05/pan-os-globalprotect-authentication.html - BleepingComputer, Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks, https://www.bleepingcomputer.com/news/security/palo-alto-globalprotect-vpn-auth-bypass-flaw-now-exploited-in-attacks/ ## 8\. Adverse Trace position Adverse Trace assesses CVE-2026-0322 as CVSS 8.6 HIGH, not in CISA KEV, with no confirmed exploitation in the source material. The severity is driven by the outcome (root-level code execution on a perimeter device) rather than by any observed campaign, and we are not raising it above the verified score on the strength of the product family's recent history. The client impact is highest for firms that expose PAN-OS management or dataplane interfaces to untrusted networks and that rely on the firewall as a trust boundary; for those, a root compromise is a control failure, not a host failure. We will track the vendor advisory for the affected version range and fixed releases, and we will update this advisory if CVE-2026-0322 is added to KEV or if exploitation is reported. Clients who need the affected version matrix before the vendor publishes it should contact us and we will work from the advisory directly. --- [Read the original source →](https://nvd.nist.gov/vuln/detail/CVE-2026-0322?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*