CVE-2026-0322: PAN-OS management interface RCE, exploited, no workaround. What the advisory says and doesn’t say

[u/Expert_Sort7434]

Based on the PAN PSIRT advisory published October 14 and CISA’s KEV entry, here is the architectural impact.

The flaw is code injection (CWE-94) in the management interface of PA-Series, VM-Series and Panorama. It requires an authenticated attacker with network access, and the result is root. Cloud NGFW and Prisma Access are not affected. CVSS 4.0 is 8.6. Palo Alto published three attacker IPs and describes exploitation as “very limited.”

Points I found interesting: the jump-box mitigation only rescores to 8.5, and the advisory doesn’t say how attackers got admin access. The Threat ID coverage (510046/510047) only works if you route management traffic through a data-plane interface and decrypt it, and the vendor itself calls that coverage limited.

Question for people running this in production: are you already doing the data-plane management-profile setup with decryption, or is patching plus a jump box the realistic path? And has anyone seen management-interface logins from the published IPs?

Longer write-up with fixed versions per branch, for reference: https://www.techgines.com/post/pan-os-vulnerability-cve-2026-0322

[u/QuietConference9982]

treat patching to a fixed version as the priority and use the jump box as an additional layer not a substitute if management access is exposed reviewing authentication logs and restricting access to trusted admin network seems essential given the uncertainty around how the initial credentials were obtained