Palo Alto Networks reported on October 14 that CVE-2026-0322 has seen very limited exploitation. The PAN-OS management-interface vulnerability allows an authenticated attacker with network access to execute code with root privileges.
The advisory covers PA-Series and VM-Series firewalls and Panorama appliances; Cloud NGFW and Prisma Access are excluded. Fixed releases differ across software branches. At review, the table still marked PAN-OS 11.2.16 as expected October 15, so administrators should confirm availability before scheduling that upgrade.
The vendor recommends restricting management access to trusted internal addresses and upgrading affected systems. It lists no known workaround and describes available Threat Prevention coverage as limited.
NAOAT analysis
The operational question is which team can account for every management endpoint. A firewall inventory should distinguish the device handling traffic from the interface used to administer it. A production address alone does not describe who can reach the management service or which accounts can use it.
For a change record, useful evidence includes the installed build, the applicable row in the vendor advisory, the selected replacement build and the responsible operator. Recording the branch matters because a generic statement that a device is on a recent version cannot establish whether it includes the relevant fix.
Access review and software remediation also answer different questions. The former documents the permitted administrative path; the latter documents the installed correction. A completion check should capture both, including confirmation that the intended configuration survived the maintenance window. Teams should preserve any investigation findings separately rather than treating a successful upgrade as proof that no earlier compromise occurred.