PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
Act NowCVSS 8.6CVE-2026-0322Oct 14, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary
A remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted.
What this means
What could happen
An authenticated attacker who can reach your firewall's management interface could run commands with root-level access, potentially disrupting network traffic filtering, modifying security policies, or causing the firewall to stop functioning.
Who's at risk
Network administrators and security teams operating Palo Alto Networks PAN-OS firewalls (PA-Series and VM-Series), Panorama appliances, and organizations managing these devices. This impacts any organization using Palo Alto firewalls for network security and access control.
How it could be exploited
An attacker with valid credentials and network access to the management interface (typically port 443 or configured management port) logs in and exploits the RCE vulnerability in the management interface to execute arbitrary commands as root on the firewall system.
Prerequisites
- Valid authentication credentials for the management interface
- Network access to the firewall management interface (port 443 or configured management port)
- Access from an IP address not restricted by management interface access lists
actively exploited (KEV)requires valid credentials but high impactaffects critical network security infrastructurehigh CVSS score (8.6)
Exploitability
Actively exploited — confirmed by CISA KEV
Public Proof-of-Concept (PoC) on GitHub (1 repository)
Affected products (9)
4 with fix5 pending
ProductAffected VersionsFix Status
Cloud NGFWBelow 12.2.4No fix yet
PAN-OSBelow 12.1.4-h1212.2.4+
PAN-OSBelow 12.1.7-h8No fix yet
PAN-OSBelow 12.1.10-h2No fix yet
Prisma AccessBelow 11.2.4-h2212.1.4-h12+
Prisma AccessBelow 11.2.7-h2112.1.7-h8+
Prisma AccessBelow 11.2.10-h1512.1.10-h2+
Prisma AccessBelow 11.2.13-h3No fix yet
Remediation & Mitigation
0/5
Do now
0/4PAN-OS
HOTFIXUpdate PAN-OS to version 12.2.4 or later (for PAN-OS 12.1.4 branch)
HOTFIXUpdate Prisma Access to version 12.1.4-h12 or later (for PAN-OS 12.1.4 branch)
All products
WORKAROUNDRestrict management interface access to only trusted internal IP addresses using management interface access lists or firewall rules
HARDENINGDisable remote management access if not actively required; use only local console or jump-host access
Long-term hardening
0/1HARDENINGImplement network segmentation to isolate management traffic on a dedicated, restricted network
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/98e9a1f6-c83f-4c42-85d5-454593edbdf5Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.