What the vendor says

This is not an unauthenticated internet-wide exploit

CVE-2026-0322 is remote code execution in the PAN-OS management interface. The attacker needs credentials with high privileges and network access to management. If those conditions are met, Palo Alto Networks says the flaw can lead to code execution as root. The company reports very limited exploitation.

The affected products are PAN-OS on PA-Series and VM-Series firewalls and Panorama. Cloud NGFW and Prisma Access are not affected. Fixed builds differ across the 10.2, 11.1, 11.2, 12.1 and 12.2 branches, so an inventory that records only “PAN-OS 11” is not enough to decide what to deploy.

Keep the access condition in the headline

The advisory does not describe an unauthenticated attacker taking over any exposed firewall. The real concern is a vulnerable management interface reachable by someone who already has—or has stolen—privileged access.

Defender workflow

Reduce the route in, then install the right build

  1. 1

    Map management reachability. List firewalls and Panorama instances, their exact PAN-OS builds, and the networks allowed to reach management. Flag any interface reachable from the public internet or broad internal ranges.

  2. 2

    Check privileged access. Review management users, authentication events and recent configuration activity. Investigate unfamiliar high-privilege access before treating the issue as a routine upgrade.

  3. 3

    Apply the vendor-specific fix. Use Palo Alto Networks' branch-by-branch table for the correct release. Restrict management access to trusted hosts while updating; the vendor says there is no workaround that replaces the patch.

Defender note

A high score is not the whole exposure story

Two installations on the same vulnerable build may have very different risk if one management interface is isolated and the other is broadly reachable. Record both facts: the patch state and the access path. If there is evidence of a compromised administrator account, scope that incident separately from the software update.