Call: Patch now
PAN-OS CVE-2026-0322: root on your firewall, exploited, and php2shell is next in line
- Vendor
- Palo Alto Networks
- Products
- PAN-OS 10.2-12.2 and Panorama
- Date
- Status
- Open
Call: Patch now. An authenticated, high-privilege attacker who can reach the management interface can run code as root. Palo Alto reports “very limited” exploitation and has published IoC IPs. CISA added it to KEV on Oct 14.
Fixed in: 12.2.4; 12.1.4-h12 / 12.1.7-h8 / 12.1.10-h2; 11.2.16; 11.1.16-h3; 10.2.18-h12, plus branch hotfixes. Cloud NGFW and Prisma Access are not affected.
Workaround: The vendor says there isn’t one. Threat IDs 510046/510047 give limited coverage, and only if you decrypt management traffic. If your management plane is reachable from the internet, you already know what this paragraph is about to say.
This is the same management UI that’s exposed to php2shell, which has no fixed build until Oct 26-30, so lock down management access now.
Sources: Palo Alto advisory, BleepingComputer.
Sources
- https://security.paloaltonetworks.com/CVE-2026-0322/
- https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/
- https://ismalicious.com/cve/kev/2026-10
- https://ctipilot.ch/entries/2026-10-22/pan-os-panorama-php2shell-mgmt-interface-no-fixed-release/
- https://security.paloaltonetworks.com/?product=PAN-OS