CVE-2026-0322

Pan-os

93/100

confirmed exploited

CVSS8.6

EPSS1.1%

KEV (CISA + VulnCheck)EXPLOITED

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-t

Listed in CISA KEV and VulnCheck KEV (confirmed exploited in the wild) · EPSS 0.011 (probability of exploitation) · CVSS base 8.6 · 1 public PoC/exploit reference(s) available

Public PoC / Exploit1

Defensive review only — these references demonstrate exploitability.

githubIfe-ella/CVE-vulnerability (★0)

References4

NVD detail Vendor advisorysecurity.paloaltonetworks.com Referencecisa.gov CISA advisorycisa.gov CISA advisorycisa.gov

Mentions 5

cybersecuritynews.com
CISA Warns of Palo Alto Networks PAN-OS Code Injection Vulnerability Exploited in Attacks
thehackernews.com
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
cybersecuritynews.com
Hackers Exploit Palo Alto PAN-OS 0-day Flaw to Gain Root Code Execution on Firewalls
bleepingcomputer.com
Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks
securityonline.info
Palo Alto PAN-OS RCE Vulnerability CVE-2026-0322 Actively Exploited in the Wild