CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Added to CISA KEV — Detection and Remediation Guide

On October 14, 2026, CISA added CVE-2026-0322 to its Known Exploited Vulnerabilities (KEV) catalog, confirming what many of us in the IR community have been bracing for: a code injection vulnerability in Palo Alto Networks PAN-OS is being actively exploited in the wild right now.

This is not a theoretical exercise. Per the CISA listing, PAN-OS contains a code injection vulnerability that allows an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall itself. Your perimeter device — the appliance you trust to inspect everything — becomes the attacker's beachhead, running their code with the highest possible privilege level on the box.

If you operate PAN-OS firewalls, this is a drop-everything event. Federal agencies are bound by CISA's Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk," including its Forensics Triage Requirements — but every organization running PAN-OS should treat this with the same urgency. Edge and perimeter devices remain the single most-targeted asset class we've engaged on across the last two years of incident response work, and a root-level code execution flaw on a firewall is exactly the kind of capability sophisticated actors burn resources to acquire.

Technical Analysis

What We Know

Why "Authenticated" Doesn't Mean "Safe"

I want to address the dismissal we hear in every engagement involving an authenticated vulnerability: "It needs credentials, so our exposure is low." That reasoning fails in practice for three reasons:

1. Credential theft precedes exploitation. In virtually every edge-device intrusion we've worked, valid administrative credentials were harvested first — via phishing, password reuse, exposed management portals, or previously compromised service accounts. The authentication requirement is a speed bump, not a wall.
2. Exposed management interfaces are endemic. Our external attack surface assessments routinely find PAN-OS management web interfaces reachable from the internet or from flat internal segments where any compromised workstation can reach them. If your management plane is broadly reachable, "authenticated with network access" describes a large population of potential attackers.
3. Root on the firewall is game over for network trust. An attacker with code execution as root on PAN-OS can intercept or modify traffic in flight, extract credentials from authentication flows, disable logging, implant persistence, and pivot into protected segments — all while appearing as legitimate firewall activity.

Likely Exploitation Chain (Defender's View)

Based on the vulnerability class (code injection via an authenticated network-accessible component), defenders should model the attack chain as follows:

1. Initial access to the management or web-facing plane using valid or stolen administrator credentials.
2. Injection of attacker-controlled input into the vulnerable PAN-OS component, breaking out of the intended command context and achieving OS-level command execution as root.
3. Post-exploitation: web processes or device server daemons spawning unexpected child processes (shells, downloaders, tunneling tools), file writes to non-standard locations, new or modified administrator accounts, and configuration changes to disable logging or open additional access paths.
4. Persistence and log tampering: because PAN-OS is an appliance without traditional EDR coverage, attackers rely on the fact that most organizations never forensically inspect the firewall itself. This is precisely why CISA's BOD 26-04 includes explicit Forensics Triage Requirements.

The critical observable for defenders: PAN-OS system processes (web server, device server, management daemons) spawning shells or unexpected child processes, combined with anomalous administrative authentication and configuration changes not tied to a change ticket.

Affected Platforms

The vulnerability affects PAN-OS — the operating system powering Palo Alto Networks PA-Series hardware firewalls, VM-Series virtual firewalls, and CN-Series container firewalls. Consult the Palo Alto Networks security advisory for CVE-2026-0322 for the authoritative list of affected and fixed versions for your specific train. Do not assume your version is unaffected because it is "recent" — verify against the vendor advisory explicitly.

Detection & Response

Detection on network appliances is harder than on endpoints — there's no CrowdStrike or Defender agent on the box. Your detection strategy must rely on three telemetry sources:

1. PAN-OS syslog forwarded to your SIEM (System, Config, Traffic, and Threat logs via syslog/CEF).
2. Authentication telemetry — who authenticated to the firewall, from where, and when.
3. Network behavior of the firewall itself — the appliance initiating outbound connections it has no business making.

Sigma Rules

The following rules target the highest-fidelity observable behaviors. Deploy them against your syslog ingestion pipeline. Note that the second rule assumes PAN-OS logs are normalized into a Sigma-compatible field schema; map field names to your pipeline.

---
title: PAN-OS Administrative Authentication from Untrusted Source
description: Detects successful administrative logons to Palo Alto Networks firewalls originating from IP addresses outside the designated management network, consistent with exploitation of CVE-2026-0322 requiring authenticated network access.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/10/15
status: experimental
id: 8f2c4a91-3b7e-4d5a-9c1f-2e6b8d0a4f71
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1190
logsource:
  product: paloalto
  service: system
detection:
  selection:
    EventName|contains:
      - 'general'
    Description|contains:
      - 'logged in'
      - 'authentication succeeded'
  filter_mgmt_subnet:
    SourceIP|cidr:
      - '10.0.0.0/8'
      - '192.168.100.0/24'
  condition: selection and not filter_mgmt_subnet
falsepositives:
  - Administrators legitimately connecting via VPN — restrict filter to known VPN egress ranges
  - Jump host access not yet documented in the management subnet list
level: high
---
title: PAN-OS Configuration Change Followed by Log Forwarding Modification
description: Detects configuration events on PAN-OS that disable or alter log forwarding, scheduled exports, or admin accounts — a common post-exploitation behavior after root-level compromise of the appliance as enabled by CVE-2026-0322.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/10/15
status: experimental
id: 4d7e1b63-8a2f-4c9d-b3e5-7f0a1c6d9e28
tags:
  - attack.defense_evasion
  - attack.t1562.008
  - attack.persistence
  - attack.t1136
logsource:
  product: paloalto
  service: config
detection:
  selection:
    Command|contains:
      - 'log-forwarding'
      - 'syslog'
      - 'delete'
      - 'disable'
    ObjectPath|contains:
      - 'log-settings'
      - 'server-profile'
      - 'admin'
      - 'mgt-config'
  condition: selection
falsepositives:
  - Legitimate change windows — correlate every match against your change management system before tuning
level: high
---
title: Firewall Appliance Initiating Unusual Outbound Connection
description: Detects PAN-OS firewall appliances initiating outbound connections to non-Palo Alto Networks destinations. A compromised firewall running attacker code as root (CVE-2026-0322) commonly establishes reverse shells or C2 channels outbound from the appliance itself.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/10/15
status: experimental
id: 1c9a5e47-6f3b-4d8a-a2c4-9b0e5f7d3a16
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1105
logsource:
  category: firewall
detection:
  selection:
    SourceZone: 'management'
    DestinationZone:
      - 'untrust'
      - 'outside'
      - 'internet'
  filter_vendor_update:
    DestinationHost|contains:
      - 'paloaltonetworks.com'
      - 'updates.paloaltonetworks.com'
  condition: selection and not filter_vendor_update
falsepositives:
  - DNS resolvers, NTP, and threat intelligence feed destinations — baseline your appliances' legitimate outbound destinations and allowlist them
level: medium

KQL Hunt — Microsoft Sentinel

This query hunts across PAN-OS logs ingested into Sentinel (via CEF/Syslog collector) for the exploitation pattern: anomalous admin authentication followed by configuration tampering. Run it against at least the last 30 days — exploitation predates the KEV listing in nearly every case.

// Hunt 1: Anomalous PAN-OS admin logons followed by config changes within 2 hours
let Lookback = 30d;
let AdminLogons =
    CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where DeviceVendor == "Palo Alto Networks"
    | where DeviceProduct has "PAN-OS"
    | where Message has_any ("logged in", "authentication succeeded", "Login success")
    | extend AdminUser = coalesce(SourceUserID, SourceUserName)
    | project LogonTime = TimeGenerated, AdminUser, SourceIP, DestinationHostName, Message;
let ConfigChanges =
    CommonSecurityLog
    | where TimeGenerated > ago(Lookback)
    | where DeviceVendor == "Palo Alto Networks"
    | where Message has_any ("config", "commit", "log-forwarding", "syslog", "admin", "delete", "disable")
    | extend AdminUser = coalesce(SourceUserID, SourceUserName)
    | project ChangeTime = TimeGenerated, AdminUser, SourceIP_Change = SourceIP, ChangeMessage = Message, DestinationHostName;
AdminLogons
| join kind=inner ConfigChanges on AdminUser, DestinationHostName
| where ChangeTime between (LogonTime .. LogonTime + 2h)
| summarize Events = count(), FirstLogon = min(LogonTime), LastChange = max(ChangeTime),
    ChangeMessages = make_set(ChangeMessage, 20)
    by AdminUser, SourceIP, DestinationHostName
| order by FirstLogon desc;

// Hunt 2: Firewall-originated connections to rare external destinations (C2 after root compromise)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor == "Palo Alto Networks"
| where SourceIP in (toscalar(
    CommonSecurityLog
    | where DeviceVendor == "Palo Alto Networks"
    | distinct DeviceAddress))
| where DestinationIP !startswith "10." and DestinationIP !startswith "192.168." and DestinationIP !startswith "172.16."
| summarize ConnectionCount = count(), Ports = make_set(DestinationPort)
    by SourceIP, DestinationIP, DestinationHostName
| where ConnectionCount < 50   // rare destinations are more interesting than high-volume updates
| order by ConnectionCount asc;

Velociraptor VQL — Forensic Triage of Compromised Appliances and Connected Systems

BOD 26-04's Forensics Triage Requirements mean you must preserve and examine evidence, not just patch and move on. Because you cannot run Velociraptor directly on the PAN-OS appliance, deploy it on management jump hosts and admin workstations that have authenticated to the firewall — these are prime lateral-movement and credential-theft targets in a firewall compromise scenario.

-- Hunt admin workstations/jump hosts for evidence of PAN-OS credential access
-- and suspicious SSH/browser sessions to firewall management interfaces

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(ssh|putty|plink).*(10\.|192\.168\.|firewall|pan-os|pa-)'
   OR CommandLine =~ '(?i)(curl|wget|invoke-webrequest|certutil|bitsadmin)'
ORDER BY CreateTime DESC

-- Examine network connections from admin hosts to firewall management ports
SELECT Pid, Name, Status, Laddr as LocalAddress, Lport as LocalPort,
       Raddr as RemoteAddress, Rport as RemotePort, Family, Type
FROM netstat()
WHERE RemotePort in (22, 443, 4443, 3978)
  AND Status =~ 'ESTABLISHED'
  AND Name =~ '(?i)(ssh|putty|plink|chrome|firefox|msedge)'

Verification & Hardening Script

The following Bash script is designed for your management/jump host to audit PAN-OS exposure: verifying management interface reachability, enumerating admin sessions, and confirming syslog forwarding health via the PAN-OS XML API. Run it from a host with API access to your firewalls.

#!/bin/bash
# CVE-2026-0322 PAN-OS Exposure & Posture Audit
# Run from a management host with network access to firewall management interfaces.
# Requires: curl, a read-only API key, and a list of firewall management IPs.

API_KEY="YOUR_READONLY_API_KEY"
FIREWALL_LIST="firewalls.txt"   # one management IP/FQDN per line
OUTPUT="panos_audit_$(date +%Y%m%d_%H%M%S).csv"

echo "firewall,panos_version,active_admin_sessions,syslog_forwarding_ok" > "$OUTPUT"

while read -r FW; do
  [ -z "$FW" ] && continue
  echo "[*] Auditing $FW ..."

  # 1. Retrieve PAN-OS version - compare output against the vendor advisory for CVE-2026-0322
  VERSION=$(curl -sk "https://$FW/api/?type=version&key=$API_KEY" \
    | grep -oP '(?<=<sw-version>)[^<]+')

  # 2. Enumerate active admin sessions - any unfamiliar source IPs demand investigation
  SESSIONS=$(curl -sk "https://$FW/api/?type=op&cmd=<show><admins></admins></show>&key=$API_KEY")
  SESSION_COUNT=$(echo "$SESSIONS" | grep -o '<entry' | wc -l)
  echo "$SESSIONS" | grep -oP '(?<=<from>)[^<]+' | sort -u | \
    while read -r SRC; do echo "    [!] Admin session from: $SRC"; done

  # 3. Verify syslog server profiles still exist and are referenced (log tampering check)
  SYSLOG=$(curl -sk "https://$FW/api/?type=config&action=get&xpath=/config/devices/entry/deviceconfig/system/log-settings/syslog&key=$API_KEY")
  if echo "$SYSLOG" | grep -q '<entry'; then SYSLOG_OK="yes"; else SYSLOG_OK="MISSING-CHECK-NOW"; fi

  echo "$FW,$VERSION,$SESSION_COUNT,$SYSLOG_OK" >> "$OUTPUT"
done < "$FIREWALL_LIST"

echo ""
echo "[+] Audit complete: $OUTPUT"
echo "[!] ACTION: Cross-reference every version against the Palo Alto advisory for CVE-2026-0322."
echo "[!] ACTION: Investigate every admin session source IP you cannot attribute to your team."

Remediation

CISA's directive for CVE-2026-0322 is unambiguous: apply mitigations per vendor instructions, in compliance with BOD 26-04 and its Forensics Triage Requirements, or discontinue use of the product if mitigations are unavailable. Here is the operational sequence we recommend to clients:

1. Preserve Forensic Evidence First (BOD 26-04 Requirement)

Before you patch, satisfy the Forensics Triage Requirements. This is the step organizations most often skip — and the one that later makes it impossible to determine whether you were already breached:

• Export and archive all PAN-OS log types (System, Config, Traffic, Threat, WildFire) covering at least the last 90 days, plus tech-support files from each appliance.
• Snapshot VM-Series instances if feasible.
• Document current running configuration and admin account inventory.

2. Patch Immediately

• Retrieve the official Palo Alto Networks security advisory for CVE-2026-0322 from the Palo Alto Networks Security Advisories portal and identify the fixed release for your PAN-OS train.
• Upgrade to the vendor-specified fixed version. Do not settle for "we'll get it in the next maintenance window" — this is confirmed active exploitation, and CISA KEV entries carry binding deadlines for federal agencies (typically three weeks from KEV listing under BOD directives — check the KEV catalog due date for this CVE). Treat that deadline as your own.
• Verify the upgrade completed and the running version matches the fixed release (show system info).

3. Reduce the Attack Surface — Regardless of Patch Status

• Restrict management interface access to a dedicated, hardened management network or jump host reachable only via VPN with MFA. The management web interface and SSH must never be internet-exposed. Verify this from the outside, not just by reading the config.
• Enforce MFA on all administrative access to PAN-OS devices.
• Audit the administrator account inventory: disable unused accounts, rotate all admin credentials, and invalidate active sessions after patching (an attacker's existing session can survive a reboot-patched box if not killed).

4. Hunt Before You Declare Clean

Patching closes the door; it does not evict anyone already inside. Because exploitation grants root on an appliance with no EDR, assume compromise may predate the patch:

• Run the detection content above against 30–90 days of retained logs.
• Investigate any unexplained admin authentication, configuration changes to log forwarding, or appliance-originated outbound connections.
• If you find indicators of compromise, treat the firewall as compromised: full credential rotation for anything that transited or terminated on it, forensic review of adjacent systems, and escalation to your IR retainer if you have one.

5. If Mitigations Are Unavailable

CISA's guidance is explicit: if vendor mitigations cannot be applied, discontinue use of the product. For most organizations that means compensating controls (strict ACL isolation of the management plane, disabling the vulnerable interface) as a bridge — not a destination — while planning replacement.

Bottom Line

A root-level code injection on your perimeter firewall, confirmed under active exploitation, is as serious as infrastructure vulnerabilities get. The firewall sees everything, trusts everything, and — in most environments — is forensically invisible. Patch on CISA's timeline, lock down the management plane permanently, preserve your forensic evidence per BOD 26-04, and hunt before you declare the incident closed.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub