CVE-2026-0322 is a code injection vulnerability (CWE-94) in the management interface of Palo Alto Networks PAN-OS. An attacker who is authenticated to the management interface and can reach it over the network can run arbitrary code with root privileges on the firewall. It is rated CVSS v4.0 8.6 (High). No special configuration is needed, but the risk is highest where the management interface is reachable from the internet, and because the flaw needs valid administrator credentials, stolen or weak credentials make it easier to use.

The following PAN-OS versions are affected on PA-Series and VM-Series firewalls and on Panorama (virtual appliances and M-Series):

• PAN-OS 12.2 before 12.2.4
• PAN-OS 12.1 before 12.1.10-h2
• PAN-OS 11.2 before 11.2.16
• PAN-OS 11.1 before 11.1.16-h3
• PAN-OS 10.2 before 10.2.18-h12

Not affected / patched version:

• PAN-OS 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 or 10.2.18-h12 or later, as applicable. Older minor releases have their own hotfix builds listed in the vendor advisory, and unsupported releases must be migrated. Cloud NGFW and Prisma Access are not affected

Successful exploitation may allow attackers to:

• Run commands as root on the firewall or Panorama after logging in to the management interface, taking full control of the device
• Change firewall rules, intercept or redirect traffic, and steal VPN and administrator credentials and configuration secrets
• Use the compromised firewall or Panorama, which manages many firewalls, as a foothold into the network

CERTVU recommends the following:

1. Patch to the fixed release

   Upgrade each firewall and Panorama to the fixed build for its branch. Palo Alto Networks states there is no complete workaround, so patching is the remediation.

2. Lock down management access

   Do not expose the management interface to the internet. Restrict it to a hardened jump box or trusted administrator IP addresses and use multi-factor authentication. This reduces the exposure but does not fix the flaw.

3. Use Threat Prevention signatures as partial cover

4. Hunt for compromise

5. Rotate credentials