Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.6
CVE-2026-0322: PAN-OS firewalls let logged-in user run code as admin
CVE-2026-0322 · published 4 days ago · actively exploited
Summary
Palo Alto Networks' PAN-OS, Cloud NGFW, Prisma Access, and related firewall software can let someone who is already signed in and has network access run any program with full system rights. This could let an attacker take control of the firewall and change its behavior. Apply the latest software updates from Palo Alto Networks and limit who can log in to the firewall management interface.
What to do
- Update palo alto networks pan-os to version 12.2.4.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| palo alto networks | pan-os |
< 12.2.4 Fix: upgrade to 12.2.4
|
| palo alto networks | cloud ngfw | All versions |
| palo alto networks | prisma access | All versions |
| paloaltonetworks | pan-os |
< 10.2.0 >= 12.2.0, < 12.2.4 10.2.7 10.2.8 10.2.9 10.2.10 10.2.11 10.2.12 10.2.13 10.2.14 10.2.15 10.2.16 43 more version ranges
cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:* |
Original advisory text
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
References
- https://security.paloaltonetworks.com/CVE-2026-0322 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource
Internet-facing
3 days
and check for signs of compromise
Internal
14 days
- Known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Known exploited
Listed in the CISA KEV catalogue - exploitation confirmed in the wild.
1%
chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published14 Oct 2026
Updated16 Oct 2026
First seen14 Oct 2026
Track software like this
Free during beta