type: cve · created: 2026-10-14 · updated: 2026-10-14 · tags: [cve, zero-day, palo-alto, pan-os, rce, kev, active-exploitation] · confidence: high · severity: high · affected_sectors: [global, government, technology] · au_impact: true
A remote code execution vulnerability in PAN-OS that allows an authenticated attacker with network access to the management interface to execute code as root on vulnerable appliances. Palo Alto Networks released security updates and confirmed that the flaw has been exploited in attacks; CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities catalogue on 14 October 2026. Management interfaces should be restricted to trusted networks immediately and the vendor patch applied ahead of the 4 November federal remediation deadline.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-0322 |
| Vendor / product | Palo Alto Networks — PAN-OS |
| Severity | High (vendor advisory) |
| KEV | Yes — added 2026-10-14 |
| Exploitation | Confirmed in the wild |
| Access required | Authenticated, network access to the management interface |
| Impact | Remote code execution as root |