Threat operations/Vulnerabilities / CVE activity
AL
Member accessPublic view · sign in
How threat priority works

CVSS gives technical context. It never enters the VTP threat score. Public exploitation evidence and observations from your honeypots are separate facts.

Vulnerability threat dossier

CVE-2026-0322

paloaltonetworkspan-os

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

VTP deterministic threat38.7of 100 · CVSS excluded

VTP analyst assessment

PAN-OS management-interface RCE

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateCANDIDATE CREATED
AI priorityCRITICAL
AI confidence88%
Public exploitation · VTP factKEV

Assessment

Palo Alto Networks reports limited exploitation of this PAN-OS zero-day, and CISA KEV lists it as exploited. An authenticated attacker with network access to the management interface can execute arbitrary code with root privileges.

Why it matters

  • The affected interface administers the firewall, a high-value network control point.
  • Root code execution could let an attacker change firewall operations or use the device for further access.

Evidence

3 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

The reported exploitation is described as limited; the supplied reporting does not define its scope.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

If you use affected PAN-OS, apply the security update and restrict management-interface access to trusted internal IP addresses.

AI baseline history (5)
  1. BASELINE ASSESSED
    PAN-OS management-interface RCEgpt-5.6-terra · low
  2. BASELINE ASSESSED
    PAN-OS management-interface code executiongpt-5.6-terra · low
  3. BASELINE ASSESSED
    Palo Alto Networks PAN-OS management-interface code executiongpt-5.6-terra · low
  4. BASELINE ASSESSED
    PAN-OS management-interface RCE is reported as exploitedgpt-5.6-terra · low
  5. BASELINE ASSESSED
    PAN-OS code injectiongpt-5.6-terra · low
Technical severityHIGHCVSS 8.6 · technical context
Public exploitationKEVGlobal public evidence
Exploit maturityTECHNICAL DETAILSReliability not implied
EPSS0.0168th percentile · prediction
Evidence confidence64%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    CISA KEV lists this vulnerability as known to be exploited globally.

  2. 02

    EPSS is 0.01; this is predictive context, not exploitation evidence.

  3. 03

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

KEV ADDEDCISA KEV entry added
03

Claim provenance

Evidence and source independence

3publications detected
3underlying evidence chains

0 primary sources · 0 dependent secondary reports · 3 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimZERO DAYPUBLICATION REPORTS ZERO DAY
64%claim confidence
UNKNOWNreport:3801551e774a8d3d3a3d39f034fa61b6cad6a667f4b3d59428a78661f1446d08ACTIVE
Evidence
Source claimEXPLOITATION REPORTEDPUBLICATION REPORTS EXPLOITATION
60%claim confidence
UNKNOWNreport:055e7ba6808989e7e27a578db3111ca0aef2f5ca1b3212f36b507bf6cd755c1dACTIVE
Evidence
Source claimZERO DAYPUBLICATION REPORTS ZERO DAY
64%claim confidence
UNKNOWNreport:055e7ba6808989e7e27a578db3111ca0aef2f5ca1b3212f36b507bf6cd755c1dACTIVE
Evidence
04

Event history

Threat timeline

  1. 06:5915 Oct
    ZERO DAY

    Zero Day

    SecurityWeek supplied a deterministically extracted signal; review the linked evidence before escalation.

  2. 22:5614 Oct
    EXPLOITATION REPORTED

    Exploitation Reported

    BleepingComputer supplied a deterministically extracted signal; review the linked evidence before escalation.

  3. 22:5614 Oct
    ZERO DAY

    Zero Day

    BleepingComputer supplied a deterministically extracted signal; review the linked evidence before escalation.

  4. 00:0014 Oct
    KEV ADDED

    CISA KEV entry added

    CISA lists global known exploitation. This is not a VTP sensor observation.

05

Original publications

Source record

The Hacker NewsPRESSUNKNOWN

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an

CVE-2026-0322CVE-2026-76519
Separate evidence group
Original
SecurityWeekPRESSUNKNOWN

Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution

The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available. The post Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution appeared first on SecurityWeek .

CVE-2026-0322
Separate evidence group
Original
BleepingComputerPRESSUNKNOWN

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. [...]

CVE-2026-0322
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score38.7vtp-threat-v1-public
Public exploitation30 / 30
EPSS prediction0.24 / 20
Exploit availability2.5 / 15
Source independence0 / 15
Intelligence recency6 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
8.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red
CWE
CWE-94
CPE records
250
Deterministic history records
11
Primary technical reference
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.