Is a flaw that requires authentication urgent?

Yes, when it is exploited and gives root. Palo Alto reports “very limited” exploitation targeting the management interface. The authentication step is only a step for an attacker who already holds credentials, stolen or reused, as the FortiBleed campaign described on October 6 shows. The fix and the interface restriction go together.

Which PAN-OS versions are fixed?

The bulletin lists fixed versions for every affected branch, from 10.2 to 12.2, for example 12.2.4 or later on the 12.2 branch. Some 11.2 releases were announced for October 15. Cloud NGFW and Prisma Access are not affected. Check the bulletin's table for your exact version.

Is there a workaround?

Palo Alto writes that there are no known workarounds. Threat Prevention subscribers get limited coverage with Threat IDs 510046 and 510047, which require SSL decryption. The measure that really reduces exposure is to make the management interface reachable only from trusted internal addresses.

Analysis · Exposure

PAN-OS: the management interface, again

On October 14, 2026, Palo Alto reported exploitation of a PAN-OS management interface flaw that gives root. Fixed versions, the Cisco KEV entry, what to do.

By Sentrix · Published 2026-10-14

On October 14, 2026, Palo Alto Networks published a bulletin on CVE-2026-0322, an already exploited flaw in the PAN-OS management interface, and CISA added it to its KEV catalog the same day. The same KEV batch held a Cisco email gateway flaw. Two more edge devices, and the same lesson: the admin interface must not be reachable by just anyone.

What the bulletins say

Palo Alto Networks (October 14). The bulletin, titled "Authenticated Remote Code Execution (RCE) in the Management Interface", describes a flaw that "enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall". On exploitation: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." Severity is "HIGH", suggested urgency "HIGHEST".

Affected branches run from PAN-OS 10.2 to 12.2, with a fixed version per branch; Cloud NGFW and Prisma Access are not affected. The bulletin states there are "no known workarounds". Threat Prevention subscribers get limited coverage with Threat IDs 510046 and 510047, provided SSL decryption is on.

CISA (October 14). The agency added to the KEV catalog CVE-2026-0322 ("Palo Alto Networks PAN-OS Code Injection Vulnerability") and CVE-2026-76519 ("Cisco Secure Email Gateway Relative Path Traversal Vulnerability"), together with two Ahsay AhsayCBS flaws. The due date for US federal agencies is October 17. The alert recalls that BOD 26-04 prioritises flaws on exposed assets that "grant total control of the asset post-exploitation".

Why it matters

In two weeks the same family of assets keeps coming back: NetScaler, FortiMail, Ivanti, now a PAN-OS firewall and a Cisco email gateway. These are the devices that form the network's edge, and the ones whose admin interface is most often left reachable for convenience.

A flaw that requires authentication is falsely reassuring. On October 6, the FBI and the Secret Service described a whole campaign, FortiBleed, built on stolen and mass-cracked firewall admin credentials. An attacker who already has a valid password only needs a reachable interface.

The lack of a workaround matters too. Palo Alto lists no known workaround, and the signature coverage it offers depends on SSL decryption, which many deployments do not run on management traffic. Until the fixed version is installed, the only real protection is that the interface cannot be reached.

What we think at Sentrix

Restrict the management interface first. Trusted internal addresses only, never the internet. It is the measure that also protects against the next flaw.
Then patch, version by version. Record the exact version of each firewall and compare it with the bulletin's table; some fixed 11.2 releases came later than the others.
Check the Cisco email gateway if you run one: CVE-2026-76519 has also been in the KEV catalog since October 14, with the same due date.
Review the firewalls' admin accounts, as for FortiBleed: an unknown account is an incident.
Keep the inventory of the edge and of each management interface's exposure. That is what the continuous exposure (CTEM) module keeps current, and what our network security service applies.

For an MSP or an MSSP, the question is not "are we affected?" but "at which clients is the management interface reachable?". A view across every client, with each interface's version and exposure, answers in minutes.

The next step

Today, test from outside your network whether the management interface of each of your firewalls answers. Any answer is to fix before the patch itself. If you want to run that test with us, contact us.

Sources

Frequently asked questions

Is a flaw that requires authentication urgent?: Yes, when it is exploited and gives root. Palo Alto reports “very limited” exploitation targeting the management interface. The authentication step is only a step for an attacker who already holds credentials, stolen or reused, as the FortiBleed campaign described on October 6 shows. The fix and the interface restriction go together.
Which PAN-OS versions are fixed?: The bulletin lists fixed versions for every affected branch, from 10.2 to 12.2, for example 12.2.4 or later on the 12.2 branch. Some 11.2 releases were announced for October 15. Cloud NGFW and Prisma Access are not affected. Check the bulletin's table for your exact version.
Is there a workaround?: Palo Alto writes that there are no known workarounds. Threat Prevention subscribers get limited coverage with Threat IDs 510046 and 510047, which require SSL decryption. The measure that really reduces exposure is to make the management interface reachable only from trusted internal addresses.

Let's talk about your compliance program.

Contact us