PAN-OS CVE-2026-0322: code injection under active attack

What CVE-2026-0322 is and which systems it touchesCVE-2026-0322 is a code injection flaw (CWE-94) in Palo Alto Networks PAN-OS, the operating system t...

What CVE-2026-0322 is and which systems it touches

CVE-2026-0322 is a code injection flaw (CWE-94) in Palo Alto Networks PAN-OS, the operating system that runs the company's firewalls. According to the NVD entry published on 14 October 2026, the defect sits in the management interface and lets an authenticated attacker who already has network access run arbitrary code with root privileges on the firewall itself. In plain terms: whoever gets through does not merely read traffic, they own the device that decides what traffic is allowed.

The affected range is broad. NVD lists PAN-OS versions up to 10.2.0 (exclusive), versions from 12.2.0 (inclusive) up to 12.2.4 (exclusive), and a long tail of 10.2.7 maintenance releases (h1, h3, h12, h16, h18, h19, h21, h24, h32 and many more configurations). The issue applies to PA-Series and VM-Series firewalls and to Panorama in both virtual and M-Series form. Cloud NGFW and Prisma Access are explicitly not impacted, which matters for Spanish organisations that have moved part of their perimeter to cloud-delivered security.

Severity is rated CVSS 4.0 at 8.6, which is HIGH rather than critical. It is still a serious score for a perimeter appliance, because the attack vector is network-based and the confidentiality, integrity and availability impact on the vulnerable component is high.

Why it is urgent: already exploited, with a three-day deadline

This is not a theoretical weakness waiting for a patch cycle. CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalogue on 14 October 2026, meaning there is confirmed evidence of exploitation in real attacks. The same day it gave US federal agencies until 17 October 2026 to remediate, a window of just three days.

The required action is not simply "upgrade". CISA asks for mitigations applied in line with the vendor's instructions, under its BOD 26-04 guidance on prioritising security updates by risk, plus its forensics triage requirements. Where mitigations are unavailable, the alternative is to discontinue use of the product. CISA also places the responsibility on each asset owner to assess how exposed that asset is to the internet.

There is one piece of good news in the record: the KEV entry does not list known use in ransomware campaigns. That does not make the flaw harmless. A compromised firewall gives an intruder a privileged position inside the network, and that position is often used quietly before anything else happens.

For companies in Catalonia and across Spain, the KEV listing is the signal that matters. Once a vulnerability is being exploited in the wild, the question stops being whether an attacker could reach it and becomes whether they already have.

What to do today

Inventory first. Establish whether you run PAN-OS at all, and on which models: PA-Series, VM-Series, Panorama virtual or M-Series. Then record the exact version and maintenance release of each unit, since the affected list is granular down to hotfix level.
Apply the vendor's fix or mitigation. The authoritative source is the Palo Alto Networks security advisory for CVE-2026-0322. Follow whatever update or mitigation that advisory specifies for your branch; do not assume a particular release is safe without checking it there.
Restrict management access. Palo Alto Networks states that the risk is minimised by limiting the management interface to trusted internal IP addresses, following its recommended deployment guidelines. A management plane reachable from the open internet is the difference between a contained problem and an incident.
Look for signs of intrusion. Because the flaw requires an authenticated attacker, review who can authenticate to the management interface, from where, and with which accounts. Check for unexpected configuration changes, unfamiliar administrative users and activity that does not match your change log. CISA's forensics triage guidance is a sensible reference for structuring that review.
Reduce what is exposed. Map every management interface against the public internet and close anything that does not need to be there. This is the single control that most reduces exposure while updates are scheduled.

How a cybersecurity team such as ALMC's fits in

Most small and mid-sized companies running this kind of equipment do not have someone whose full-time job is watching firewall advisories. That is usually where the gap opens: the appliance is installed, it works, and nobody revisits the management exposure or the version inventory until something breaks.

At ALMC we work on exactly that layer. We audit perimeter and web-facing infrastructure to find vulnerabilities before they are exploited, run penetration tests to confirm what is genuinely reachable, and harden servers and management planes so that privileged interfaces are not left open to the world. When a vendor advisory like this one lands, we translate it into a concrete list of assets, versions and actions for the specific estate rather than a generic recommendation.

We also handle the less glamorous side: monitoring, incident response and the maintenance of the platforms most Spanish SMEs actually run, including WordPress, PrestaShop and Joomla, plus the cleanup work when a site has already been compromised. The pattern behind CVE-2026-0322 is familiar. A known vulnerability, a short window, and an internet-facing interface nobody had inventoried. Closing that gap is a process, not a one-off patch, and it is one worth having in place before the next advisory arrives.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.