DaystoPatch

Palo Alto NetworksExploited incident

PAN-OS management interface authenticated remote code execution

CVE-2026-0322High, CVSS 8.6In CISA's Known Exploited Vulnerabilities catalog since 14 Oct 2026

  • Exploited before a fix
FixedFixed for every supported version 27 hours after the first public report.

Response

Silence
0h
First public report to first vendor statementUnverified source
Exposure
0h
First public report to first fixUnverified source
Follow-through
27h
First public report to a fix for every supported versionUnverified source
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Unverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2026-0322 (advisory page)CuratedQuote not checked yet

    2026-10-14 Initial Publication.

    Discovered internally; the vendor's own advisory is the first public signal found. It reported limited exploitation from first publication (see Wayback snapshot 20261014200243). Time from this timeline entry's data-date attribute (2026-10-14T16:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CISA KEV (CVE-2026-0322)ClaimedQuote verified14 Oct 2026

    Palo Alto Networks PAN-OS Code Injection Vulnerability

    Added to CISA's KEV catalog on 2026-10-14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet14 Oct 2026, 16:31 UTC

    Attackers are actively exploiting CVE-2026-0322, a high-severity Palo Alto PAN-OS RCE vulnerability in the management interface. Apply patches right now.

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet14 Oct 2026, 16:32 UTC

    Attackers are actively exploiting CVE-2026-0322, a high-severity Palo Alto PAN-OS RCE vulnerability in the management interface. Apply patches right now. # CVE20260322 # PaloAltoNetworks # PANOS # RCE # FirewallSecurity

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-0322ClaimedQuote verified14 Oct 2026, 17:26 UTC

    A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ffb78da08cb4e7f3…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosureUnverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2026-0322 (advisory page)CuratedQuote not checked yet

    2026-10-14 Initial Publication.

    Time from this timeline entry's data-date attribute (2026-10-14T16:00:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    at disclosure

    Palo Alto Networks advisory CVE-2026-0322 (advisory page)CuratedQuote verified

    You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface.

    Mitigation present in the initial advisory (Initial Publication 2026-10-14T16:00Z in the same document's timeline; also in Wayback snapshot 20261014200243). The advisory says no full workaround exists; Threat IDs 510046/510047 give limited coverage.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c6254df484eb1f87…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    at disclosure

    Palo Alto Networks advisory CVE-2026-0322 (Wayback snapshot 2026-10-14 20:02 UTC)CuratedQuote verified

    Upgrade to 12.2.4 or later.

    Fixed releases for 12.2, 12.1, 11.1, 10.2 and most 11.2 trains were listed at initial publication (16:00Z per CVE advisory timeline). The 20:02Z snapshot still shows 11.2.16 as '(ETA: 10/15)'. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:23f767a4209a58a4…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Palo Alto Networks advisory CVE-2026-0322ClaimedQuote verified15 Oct 2026, 18:30 UTC

    11.2.16 has been published.

    From the advisory's revision history.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c6254df484eb1f87…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    +27hUnverified: no archived copy, quote not checked yet

    Palo Alto Networks advisory CVE-2026-0322 (advisory page timeline)CuratedQuote not checked yet

    2026-10-15 11.2.16 has been published.

    Users on 11.2.14 through 11.2.15 had no fixed release until 11.2.16 shipped. Time from this timeline entry's data-date attribute (2026-10-15T18:30:00.000Z) on the same page.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • PAN-OS (PA-Series and VM-Series firewalls)
  • Panorama
How we built this timeline

Exploitation was stated in the advisory from first publication ('Very limited exploitation has been observed targeting the Palo Alto Networks management interface.'), so exploited before a fix is true even though fixes shipped the same moment. Severity is the vendor's CVSS-BT 4.0 score (8.6, HIGH).

Requires authenticated admin access to the management interface.

Related

No related incidents.

Palo Alto Networks report card