{"resourceId":"cisa-kev-cve-2026-0322-pan-os-management-interface-code-injection-20261014","versions":[{"version":"external-ec21175b18fc743067a484c1436ce0fc2f36fadd383467b403d7d799894b2546","resource":{"id":"cisa-kev-cve-2026-0322-pan-os-management-interface-code-injection-20261014","title":"CISA adds PAN-OS CVE-2026-0322 management-interface code injection to the Known Exploited Vulnerabilities catalog","organization":"Cybersecurity and Infrastructure Security Agency (CISA)","sector":"Federal cybersecurity agency / vulnerability management","geography":"United States","publishedAt":"CISA alert, Oct. 14, 2026","publicationDate":"2026-10-14","eventDate":"2026-10-14","sourceName":"CISA","sourceLabel":"CISA Adds Four Known Exploited Vulnerabilities to Catalog","sourceUrl":"https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog","evidenceClass":"government-evaluation","outcomeClass":"cautionary","topics":["infrastructure","governance-procurement"],"finding":"On Oct. 14, 2026 CISA added CVE-2026-0322, a Palo Alto Networks PAN-OS code injection vulnerability, to the KEV catalog based on evidence of active exploitation, alongside Cisco and Ahsay flaws. The alert notes BOD 26-04 requires federal civilian agencies to prioritise KEV items on exposed assets that grant total control and sets expectations for checking whether systems were compromised before patching. The vendor advisory describes CVE-2026-0322 as an authenticated root code execution flaw in the PAN-OS management interface; press reports cite an Oct. 17 federal deadline.","sledRelevance":"Two distinct exploited PAN-OS management-interface flaws in one month (this one and PHP2Shell) make management-plane exposure the dominant Palo Alto risk for state and local networks; KEV is binding only on federal agencies but is widely adopted by states as a patch priority list.","evidence":"Opened and read the CISA alert in full. Read the vendor advisory for CVE-2026-0322 and a CSO Online report for context on the deadline and affected products.","architectureImplications":"Both October PAN-OS exploits target the management interface; restricting it to trusted internal addresses is the shared control.","governanceImplications":"BOD 26-04 adds a compromise-check expectation before patch closure, a useful model for state patch policy.","securityPrivacyImplications":"Root execution on the firewall; exploitation requires credentials and network access to management.","caveats":"Federal directive does not bind state, local or education entities. The alert itself lists the CVE without technical detail; details come from the vendor advisory.","streamIds":["palo-alto-networks"],"roles":{"sales":"Sales framing: CISA confirmed active exploitation of a second PAN-OS management-interface flaw this month. The customer problem for SLED leaders is keeping pace with repeated emergency firewall patches. A bounded engagement could set up a KEV-driven patch and compromise-check process for perimeter devices. This alert cannot support claims that any state or local agency was exploited, and the federal directive does not apply to SLED entities directly.","engineering":"Engineering framing: CVE-2026-0322 needs authenticated access to the management interface, unlike PHP2Shell, but both share the same control: management reachable only from trusted internal addresses. Map devices to fixed builds from the vendor advisory and confirm Cloud NGFW and Prisma Access are unaffected. Proof of value is a re-scan showing no exposed management and a record that administrator credentials and sessions were reviewed for misuse before closure, following the BOD 26-04 model.","delivery":"Delivery framing: build a repeatable KEV response for perimeter devices rather than handling each alert ad hoc. Network operations owns patching; security owns the pre-closure compromise check. Acceptance includes time from KEV listing to patch and a documented compromise check for each exposed device. Risks are patch fatigue, skipped compromise checks and treating federal deadlines as irrelevant because they are not binding."},"roleDetails":{"sales":{"customerProblem":"SLED teams face repeated emergency PAN-OS patches without a standing process.","stakeholders":["State CIOs and CISOs","County and city IT directors","Higher-ed network managers"],"discoveryQuestions":["Do you adopt KEV deadlines for your own patch SLAs?","How do you verify a device was not compromised before closing a patch ticket?"],"valueHypothesis":"Interpretation: a standing KEV process shortens exposure windows; no measured data here.","potentialEngagement":"A KEV-driven emergency patch and compromise-check runbook for perimeter devices.","unsupportedClaims":["That SLED entities are bound by BOD 26-04","That any SLED victim exists"]},"engineering":{"fit":"Applies to PA-Series, VM-Series and Panorama; not Cloud NGFW or Prisma Access per vendor.","architectureIntegration":"Same management-plane restriction as PHP2Shell; upgrade per branch.","prerequisites":["Device inventory","Admin credential review capability"],"constraints":["Requires authenticated access, so credential hygiene matters","Federal directive not binding"],"security":"Review admin accounts and sessions for misuse on any exposed device.","proofOfValue":["Time-to-patch measured from KEV date","Compromise check recorded per device"]},"delivery":{"work":"Stand up a KEV response runbook covering firewalls.","dependencies":["KEV feed monitoring","Change process"],"ownership":"Network operations with security oversight.","skillsAdoption":"Teams need a lightweight compromise-check checklist.","governanceCheckpoints":["Emergency change approval","Closure requires compromise check"],"acceptanceCriteria":["Proposed: KEV-listed perimeter flaws patched within an agreed window","Proposed: 100% of closures include a compromise check"],"risks":["Patch fatigue","Skipped checks"]}},"retrievedAt":"2026-10-30T03:06:15Z","enrichedAt":"2026-10-30T03:12:42Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Repeated emergency patching strains small network teams.","procurementImplications":"None directly; supports including vulnerability-response obligations in managed services contracts.","operatingModelImplications":"State and local agencies that mirror KEV deadlines need a standing emergency-change path for perimeter devices.","sourceVerification":{"openedUrl":"https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog","referenceExcerpt":"CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}