From the Palo Alto Networks edition of October 29, 2026
CISA adds PAN-OS CVE-2026-0322 management-interface code injection to the Known Exploited Vulnerabilities catalog
Cybersecurity and Infrastructure Security Agency (CISA) · Federal cybersecurity agency / vulnerability management · United States
- Publisher
- CISA
- Original publication
- CISA alert, Oct. 14, 2026
- Source retrieved
- 2026-10-30
- Event date
- 2026-10-14
What happened
On Oct. 14, 2026 CISA added CVE-2026-0322, a Palo Alto Networks PAN-OS code injection vulnerability, to the KEV catalog based on evidence of active exploitation, alongside Cisco and Ahsay flaws. The alert notes BOD 26-04 requires federal civilian agencies to prioritise KEV items on exposed assets that grant total control and sets expectations for checking whether systems were compromised before patching. The vendor advisory describes CVE-2026-0322 as an authenticated root code execution flaw in the PAN-OS management interface; press reports cite an Oct. 17 federal deadline.
Why it matters
Two distinct exploited PAN-OS management-interface flaws in one month (this one and PHP2Shell) make management-plane exposure the dominant Palo Alto risk for state and local networks; KEV is binding only on federal agencies but is widely adopted by states as a patch priority list.
Evidence and measured results
Opened and read the CISA alert in full. Read the vendor advisory for CVE-2026-0322 and a CSO Online report for context on the deadline and affected products.
Limitations and uncertainty
Federal directive does not bind state, local or education entities. The alert itself lists the CVE without technical detail; details come from the vendor advisory.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-30; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- SLED teams face repeated emergency PAN-OS patches without a standing process.
- Stakeholders
- State CIOs and CISOs
- County and city IT directors
- Higher-ed network managers
- Discovery questions
- Do you adopt KEV deadlines for your own patch SLAs?
- How do you verify a device was not compromised before closing a patch ticket?
- Value hypothesis
- Interpretation: a standing KEV process shortens exposure windows; no measured data here.
- Potential engagement
- A KEV-driven emergency patch and compromise-check runbook for perimeter devices.
- Unsupported claims
- That SLED entities are bound by BOD 26-04
- That any SLED victim exists
Pre-sales engineering
Role takeaway
- Fit
- Applies to PA-Series, VM-Series and Panorama; not Cloud NGFW or Prisma Access per vendor.
- Architecture and integration
- Same management-plane restriction as PHP2Shell; upgrade per branch.
- Prerequisites
- Device inventory
- Admin credential review capability
- Constraints
- Requires authenticated access, so credential hygiene matters
- Federal directive not binding
- Security
- Review admin accounts and sessions for misuse on any exposed device.
- Proof of value
- Time-to-patch measured from KEV date
- Compromise check recorded per device
Delivery
Role takeaway
- Work
- Stand up a KEV response runbook covering firewalls.
- Dependencies
- KEV feed monitoring
- Change process
- Ownership
- Network operations with security oversight.
- Skills and adoption
- Teams need a lightweight compromise-check checklist.
- Governance checkpoints
- Emergency change approval
- Closure requires compromise check
- Acceptance criteria
- Proposed: KEV-listed perimeter flaws patched within an agreed window
- Proposed: 100% of closures include a compromise check
- Risks
- Patch fatigue
- Skipped checks
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Both October PAN-OS exploits target the management interface; restricting it to trusted internal addresses is the shared control.
Governance
Who approves, reviews and stays accountable for outcomes?
BOD 26-04 adds a compromise-check expectation before patch closure, a useful model for state patch policy.
Security and privacy
What data, permissions and controls need testing?
Root execution on the firewall; exploitation requires credentials and network access to management.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Repeated emergency patching strains small network teams.
Procurement
What should contracts, pricing and exit terms secure?
None directly; supports including vulnerability-response obligations in managed services contracts.
Operating model
Which teams own the service once it runs?
State and local agencies that mirror KEV deadlines need a standing emergency-change path for perimeter devices.
Publication history
- 2026-10-29Palo Alto Networks · Issue 018 resources
Stable resource ID: cisa-kev-cve-2026-0322-pan-os-management-interface-code-injection-20261014