PAN-OS CVE-2026-0322: verify maintenance-line fixes and recover the management plane

What it is

Status as of 25 October 2026. This article uses the PAN-OS advisory revised 15 October 2026 and recovery instructions revised 11 August 2025. Re-check fixed maintenance releases, indicators and model-specific recovery instructions before acting.

CVE-2026-0322 permits an authenticated, highly privileged attacker with management-interface access to execute code as root. PA-Series, VM-Series and Panorama are affected; Cloud NGFW and Prisma Access are not. CISA added it to its exploited-vulnerability catalogue on 14 October 2026. Vendor advisory, CISA entry.

Why it matters

Containment must include the firewall and its management server. Palo Alto Networks recommends a dedicated management network and restricted administrator access. A permitted management path still needs authentication and monitoring; an internal address alone does not establish that the connecting host is trustworthy.

The vendor's recovery document distinguishes replacing a compromised virtual instance from resetting physical equipment. Record both the patch decision and the recovery decision for each device; installing an update does not document completion of the separate restoration procedure.

How to apply

• Record each appliance's running version with show system info, retaining the complete sw-version value and model. Repeat this check after installation and any required restart. A downloaded image or planned upgrade is not the running version. CLI reference.
• Use the advisory's maintenance-line fixes:

PAN-OS branch	Fixed maintenance releases
12.2	12.2.4
12.1	12.1.4-h12; 12.1.7-h8; 12.1.10-h2
11.2	11.2.4-h22; 11.2.7-h21; 11.2.10-h15; 11.2.13-h3; 11.2.16
11.1	11.1.4-h37; 11.1.6-h39; 11.1.7-h11; 11.1.10-h35; 11.1.13-h15; 11.1.16-h3
10.2	10.2.7-h38; 10.2.10-h41; 10.2.13-h26; 10.2.16-h11; 10.2.18-h12
All older unsupported versions	Upgrade to a supported fixed version

Releases before the applicable maintenance-line threshold are affected. Follow the advisory's Solution row for the installed release, including its later-release alternatives. A hotfix for an earlier maintenance line does not establish that every numerically higher maintenance release is fixed. Release matrix.

• Restrict the MGT interface through Device > Setup > Interfaces > Management, including Permitted IP Addresses and required services. For a dataplane interface providing management access, inspect its Interface Management Profile instead. Use a controlled administrative host and multifactor authentication. Check both paths wherever they exist. Access guide.
• Review externally retained administrator-activity and system logs. Correlate unusual logins, configuration changes and network traffic with the advisory's current indicators. Preserve findings for incident responders and support. The access guide documents external forwarding; configure it before an incident whenever possible.
• For compromised or potentially compromised hardware, contact support for an Enhanced Factory Reset. Support supplies alternatives for models that cannot use that procedure. For virtual appliances, export configuration, shut down and preserve the compromised instance's disk, and deploy a replacement. Retain the old instance until investigation is complete. Recovery procedure.
• Review configuration for unauthorized changes before restoring it. Follow the recovery procedure to replace the master key, reset passwords and other secrets, and revoke and reissue certificates whose private keys were present. Validate restored policies and restrict management access before returning the device to service.

Pitfalls

Use incident evidence to decide whether recovery is complete. Missing indicator matches do not substitute for investigating suspicious administrator access. Keep the restored configuration, running-version evidence and support recovery record together so another operator can verify what was actually done.