Code Injection in Palo Alto PAN-OS - CVE-2026-0322
Published: October 15, 2026
Vulnerability identifier: #VU155826
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-0322
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary code with root privileges.
The vulnerability exists due to improper control of code generation in the PAN-OS management interface when handling input received over the network. A remote privileged user can inject code through the management interface to execute arbitrary code with root privileges.
Note, the vulnerability is being exploited in the wild.
Affected software
Palo Alto PAN-OS
How to mitigate CVE-2026-0322
Install security update from vendor's website.
Palo Alto PAN-OS - addressed in versions 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 12.2.4