CVE-2026-0322

No ransomware group in this database is currently recorded as exploiting CVE-2026-0322.

CVE-2026-0322 affects Palo Alto Networks PAN-OS. A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

CVE-2026-0322 is rated HIGH with a CVSS base score of 7.2. EPSS puts the probability of exploitation in the next 30 days at 1.2%, higher than 68.4% of all scored vulnerabilities. It is listed in the CISA Known Exploited Vulnerabilities catalog, with a federal remediation deadline of 17 October 2026.

Apply the vendor patch for Palo Alto Networks PAN-OS as the first priority, and treat any internet-facing instance as the most urgent. Because this vulnerability is associated with ransomware activity, also review whether the affected systems were reachable before patching, rather than assuming that patching alone closes the incident.