SB2026101522 - Privilege escalation in Palo Alto PAN-OS management interface

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101522

SB2026101522 - Privilege escalation in Palo Alto PAN-OS management interface

Published: October 15, 2026

Security Bulletin ID SB2026101522
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Code Injection (CVE-ID: CVE-2026-0322) Exploited

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary code with root privileges.

The vulnerability exists due to improper control of code generation in the PAN-OS management interface when handling input received over the network. A remote privileged user can inject code through the management interface to execute arbitrary code with root privileges.

Note, the vulnerability is being exploited in the wild.


Remediation

Install update from vendor's website.

References