Palo AltoPAN-OSRCEKEVfirewall

Palo Alto PAN-OS: CVE-2026-0322 exploited, no workaround, and three days for federal agencies

Name: CleanIssue
Price range: €€

Published on 2026-10-145 min readCleanIssue

> TL;DR: On October 14, 2026, CISA added CVE-2026-0322 to the KEV catalog. It is a code injection flaw in PAN-OS, the operating system of Palo Alto firewalls, reachable through the management interface. Palo Alto describes exploitation as very limited, but there is no known workaround: only the patch fixes it. U.S. federal agencies have until October 17.

What is affected

Products: PA-Series, VM-Series and Panorama running PAN-OS.

Out of scope: Cloud NGFW and Prisma Access are not affected.

Fixed builds: 10.2.18-h12, 11.1.16-h3, 11.2.16, 12.1.10-h2 and 12.2.4, according to the sources. One source cites 11.2.13-h3 for the 11.2 branch. Check Palo Alto's advisory for your exact branch before scheduling the upgrade.

Why the management interface is the real issue

A firewall does more than filter: all of your traffic passes through it. If its administration interface is reachable from the Internet, a flaw there gives control of the device that governs your flows. The sources disagree on whether an account is needed to exploit it. Until Palo Alto settles the question, treat the flaw as exploitable without authentication.

What to do now

Cut Internet access to the administration interface. Keep it reachable only from internal addresses or an administration VPN. This is the only measure that reduces risk before the patch.

Install the fix for your branch. Threat Prevention signatures cover only part of the attacks, and only when configuration and content-version requirements are met. They do not replace the upgrade.

Look for traces in administration logs: unknown logins, changed configurations, new accounts, unexpected reboots.

If the device was exposed before the patch, rotate the administration credentials and any secrets stored on it.

The takeaway

A firewall is often the one device nobody watches, because it keeps working. Its administration console should be treated as a priority system to protect, not as a configuration detail.

Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.

Three adjacent analyses to keep exploring the same attack surface.

FortinetFortiMail

FortiMail: a pre-auth RCE in the POP3 service (CVE-2026-44812) joins the CISA KEV

Heap buffer overflow in the FortiMail POP3 service: unauthenticated code execution, CVSS 8.8. CISA lists it in the KEV on October 2 (deadline October 30). Fixed in 7.6.6 and 8.0.4 — 9,412 instances remain exposed per Palo Alto Unit 42.

2026-10-02 · 6 min read

CitrixNetScaler

Citrix NetScaler: CVE-2026-88779, a third pre-auth RCE that also hits the 88771/88772-patched builds — CISA KEV

CISA lists CVE-2026-88779 in the Known Exploited Vulnerabilities: pre-authentication RCE via a race condition in the Web Interface session manager, CVSS 9.1, also affecting the versions fixed for 88771/88772. watchTowr has a PoC, 43,812 instances remain exposed, CISA deadline October 30.

2026-10-01 · 6 min read

CitrixNetScaler

Citrix NetScaler: two pre-auth RCEs, 50,277 exposed instances, CISA deadline Sept 30

CISA lists CVE-2026-88771 and CVE-2026-88772 in the Known Exploited Vulnerabilities: pre-authentication code execution on NetScaler ADC and Gateway, CVSS 9.5. watchTowr has a PoC, GreyNoise observed the first exploitations on September 24, and over 50,000 instances remain exposed.

2026-09-28 · 6 min read

Sources

Written by CleanIssue

Reviewed on 2026-10-14

Related services

If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.

Agent Red Team Express

Find out quickly what a stranger can make your agent do. Report in 5 days.

Custom Red Team

Several agents, MCP servers or agents delivered by an agency: on quote.

The Shield

Software that will block unauthorized actions. In development, early access for first customers.