Palo Alto Networks published its October advisories on 14 October 2026. Two of them matter for most firewall admins, and the good news is that one upgrade fixes both.
CVE-2026-0322: root on the firewall through the management interface
This is the important one. An attacker who can reach the PAN-OS management interface and has valid credentials can run code as root on the firewall. CVSS 4.0 score is 8.6, but Palo Alto set the suggested urgency to HIGHEST, because "very limited exploitation has been observed".
- Affects PA-Series, VM-Series and Panorama.
- Cloud NGFW and Prisma Access are not affected.
- No special configuration is needed. The biggest risk is a management interface reachable from the internet.
There is no full workaround, but these reduce the risk a lot:
- Allow management access only from a jump box or trusted internal IPs. Honestly, this should be done anyway.
- Threat IDs 510046 and 510047 give limited coverage, but only if you decrypt the management traffic and run content 9159-10287 or later.
- Replace the inbound management certificate.
CVE-2026-0319: GlobalProtect session as another user
This one is rated Medium. A user who is already authenticated to GlobalProtect can establish a session using another user's identity. Think about what that means for User-ID based policies: someone could get the access rules of a different person.
- No special configuration needed, and no workaround.
- Not known to be exploited. It was found internally.
- Cloud NGFW and Panorama are not affected. Prisma Access is upgraded by Palo Alto in the maintenance cycle.
Which version fixes both?
Both advisories list the same fixed releases. Pick the one for your train:
| Branch | Fixed in (or later) |
|---|---|
| 12.2 | 12.2.4 |
| 12.1 | 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 |
| 11.2 | 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16 |
| 11.1 | 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3 |
| 10.2 | 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12 |
Older, unsupported PAN-OS versions are affected too. If you are still on one, this is your reminder to move to a supported train.
Quick checklist
- Is the management interface reachable from the internet? Test it from outside. If yes, fix that first.
- Upgrade to the fixed hotfix in your train.
- Review admin logins and config changes from the last few weeks.
Personal view only. Always check the Palo Alto advisory for your exact version.
Comments
No comments yet. Share your own debugging war story.