Palo Alto Networks Patches Exploited PAN-OS Management Interface RCE (CVE-2026-0322)

Scope: PAN-OS (Cloud NGFW and Prisma Access not affected)

Severity: Amber

Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), a remote code execution flaw in the PAN-OS management interface, amid confirmed active exploitation. Unlike a fully unauthenticated bug, this one requires an attacker to already have authenticated access to the management interface before they can execute code as root, which means organisations that already restrict management interface access to a small trusted group have a meaningful layer of protection in place regardless of patch status. That said, CISA has added it to the Known Exploited Vulnerabilities catalog alongside the Cisco Secure Email Gateway flaw above, both with a federal remediation deadline of October 17, 2026, so exploitation is confirmed and real. The vulnerability was discovered and reported internally by Palo Alto’s own security research team. Organisations running PAN-OS must upgrade to the fixed build for their branch and, regardless of patch timing, should confirm management interface access is restricted to trusted administrators only and never exposed to the internet.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.