Palo Alto Networks PAN-OS Code Injection Vulnerability

Summary: A code injection vulnerability (CVE-2026-0322) has been identified in Palo Alto Networks PAN-OS, allowing an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. This vulnerability is listed in the CISA KEV catalog and is actively being exploited in the wild.

This news announces a code injection vulnerability (CVE-2026-0322) found in Palo Alto Networks’ PAN-OS operating system, which is listed in the CISA KEV catalog. This vulnerability allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. This essentially means a complete compromise of the security appliance.

Code injection occurs when an application directly incorporates user-supplied data into a code interpreter or runtime environment. This vulnerability typically stems from a lack of proper input validation or sanitization. An attacker succeeds in executing their own code by disrupting the system’s normal flow with specially crafted inputs. Executing code with root privileges signifies full control over the system.

For live systems and infrastructure, the impact of this vulnerability can be extremely critical and devastating. Palo Alto Networks firewalls form the backbone of many organizations’ network security, used to filter traffic, block threats, and enforce network segmentation. Compromising a firewall with root privileges allows an attacker to manipulate network traffic, gain access to internal networks, alter security policies, or use the device as a pivot point.

Engineers using Palo Alto Networks PAN-OS must immediately apply the security updates released for this vulnerability. Furthermore, additional security measures such as tightening access controls to firewalls, using multi-factor authentication (MFA), and continuously monitoring firewall logs for anomaly detection should be implemented.

🔗 Source: CISA KEV Catalog
📡 Authoritative feeds & live tracking: Radar