PAN-OS CVE-2026-0322

Exploitation requires network reachability to the PAN-OS/Panorama management interface AND an authenticated session with high administrative privileges (CVSS PR:H) - this is not remote-unauthenticated. The attack targets PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series); Cloud NGFW and Prisma Access are explicitly not affected. The primary limiting factor is the vendor's recommended best-practice deployment: restricting management-interface access to trusted internal IP addresses largely neutralizes the exposure, so firewalls that follow this hardening guidance face substantially reduced risk, while those exposing the management plane to broader networks are most at risk.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6 and describes a network-reachable, low-complexity code-injection flaw (CWE-94) yielding full root-level compromise of PAN-OS firewalls - but the PR:H metric means the attacker must already hold high-privilege authenticated access to the management interface, which sharply narrows the realistic threat population. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was referenced, so there is no evidence of active or opportunistic exploitation at time of analysis. The signals are internally consistent rather than conflicting: a high technical impact gated behind privileged authentication and a management-plane that Palo Alto's own guidance says should never be exposed to untrusted networks. Treat this as a defense-in-depth / insider-and-post-compromise priority on security appliances rather than a drive-by internet-facing emergency; prioritize patching for any firewall whose management interface is not strictly restricted to trusted internal IPs. Note the CPE list and Tags include Cloud NGFW and Prisma Access, which the description explicitly states are NOT impacted - do not scope those products in.

An attacker who has already obtained high-privilege credentials or an authenticated session to the PAN-OS/Panorama management interface (for example via phished admin credentials or an insider) sends crafted input to the management plane, triggering code injection (CWE-94) and executing arbitrary code as root on the firewall. Because exploitation requires the privileged management interface to be reachable, impact is confined to environments where management access is not restricted to trusted internal IPs. No public proof-of-concept or exploit code was identified in the provided data.