CVE-2026-0322 explained: the Paloaltonetworks Pan-os flaw and how to fix it

The two-minute check

1. Log into the management interface of your firewall or Panorama console and note the device type shown on screen.
2. Check whether that device is a PA-Series firewall, a VM-Series firewall, or a Panorama appliance, virtual or M-Series.
3. Check whether the management interface is reachable from the internet, or only from trusted internal addresses.

When you can stop reading

The official record says Cloud NGFW and Prisma Access are not impacted by this vulnerability (vendor advisory). If you only use those services, you can close this tab. If you don't run Pan-os anywhere in your environment, this one isn't for you either.

What the official record says

This flaw carries a Common Vulnerability Scoring System (CVSS) score of 7.2, rated HIGH (NVD). The scoring detail says an attacker needs network access and a working login to the management interface, but does not need to trick anyone into clicking anything. Once logged in, they can change data, read data, and disrupt the system, all rated at the highest impact level.

The probability of exploitation in the next 30 days is 1.1%, placing it at the 64th percentile compared to other vulnerabilities (EPSS). The Exploit Prediction Scoring System (EPSS) forecasts near-term exploitation activity. It is not a measure of how severe the flaw itself is.

Separately, this flaw is already listed on the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog (CISA KEV). That listing means confirmed exploitation has already happened somewhere, not a theoretical worst case.

What that means for a business like yours

The attacker needs a valid login to your management interface first. That could be a compromised employee account, a leaked credential, or a management interface left open to the internet. Once they have that foothold, this bug lets them take full control of the computer, phone or server you run Paloaltonetworks Pan-os on. The practical lesson is that credential hygiene and network exposure matter as much as the patch itself.

If someone else manages your IT

Send this to your provider, as three separate lines:

"Please check our Pan-os firewalls and Panorama consoles for CVE-2026-0322. Please confirm the management interface is restricted to trusted internal IP addresses only. Please tell us once the fix is applied and confirmed."

If you manage it yourself

1. Open the vendor advisory and check the current fixed version for your device model.
2. Log into each firewall or Panorama console and compare its running version against that advisory.
3. Apply the vendor's update through your normal management interface update screen.
4. Restrict management interface access to trusted internal IP addresses only, using your firewall's access control settings.
5. Reboot the device if the update screen tells you to, then confirm the version again.

The answer is now. This flaw is on the CISA Known Exploited Vulnerabilities catalog (CISA KEV), with a federal remediation due date of October 17, 2026. That date applies to federal agencies, but it's a useful signal for everyone: criminals are already using this, and waiting adds risk without adding benefit.

Don't trust a progress bar. Log back into the management interface after the update and check the version number shown on the device summary screen. Compare it against the version named in the vendor advisory for your model. Then confirm, separately, that the management interface is still restricted to trusted internal addresses, not open to the wider internet.

If you can't update immediately, restrict the management interface to trusted internal IP addresses. This doesn't close the flaw, but it removes the easiest path an outside attacker would use to reach it. Review who holds valid login credentials to your firewalls and Panorama consoles, and remove any accounts you no longer need. Consider multi-factor authentication (MFA) on management access if it isn't already required. These steps reduce risk while you schedule the update; they are not a substitute for it. For help tightening who can reach sensitive management interfaces, our privileged access management team can review your setup.

Do I have to do anything if we only use this at home?

Pan-os runs on business firewalls and management appliances, not typical home routers. If you don't recognize the device names PA-Series, VM-Series, or Panorama, this almost certainly doesn't apply to you.

Will patching break anything?

The record doesn't say which builds are affected or describe any side effects of the fix. Standard practice is to apply vendor updates during a planned maintenance window, and to confirm management access still works afterward.

Does this affect our other business software?

No. This record only names Pan-os software from Palo Alto Networks. It does not mention any other vendor or product, so there's no reason to check unrelated systems because of this specific flaw.

We think an account may already be compromised. What now?

Treat that as urgent regardless of this specific flaw. Reset credentials, review login activity on the management interface, and restrict access immediately. Our cybersecurity team offers business-hours support with after-hours emergency response for exactly this kind of situation.

How do we make sure this doesn't catch us off guard again?

Regular patch review and network exposure checks catch most issues like this before they become urgent. Our managed IT services include ongoing monitoring so devices like firewalls don't fall behind on updates. If regulated data is involved, our HIPAA and FTC Safeguards Rule guidance can help you map patching into your compliance obligations.

LayerLogix brings 20+ years of experience and 100% Texas-based support to businesses across The Woodlands, Round Rock, Greater Houston, DFW, and Austin. If you want a second set of eyes on your Pan-os devices, or your wider network, start with a free IT assessment or contact us directly.