CVE-2026-0322 in PAN-OS: RCE in management interface, CVSS 8.6

An authenticated remote code execution flaw, CVE-2026-0322 (CWE-94, CVSS 8.6), was found in the PAN-OS management interface and yields root on the firewall. Risk is highest when management is reachable from the internet; fixes ship in 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 and 10.2.18-h12.

• CVSS 8.6, CWE-94: authenticated RCE yielding root on PAN-OS
• ZoomEye returned 22,494 assets with a Palo Alto Networks fingerprint
• Fixed versions: 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12
• Cloud NGFW requires no action; Prisma Access is not affected