Palo Alto PAN-OS CVE-2026-0322 management interface code injection exploited (CISA KEV): which PAN-OS versions fix it?

What it is: a code injection flaw in the PAN-OS management web interface that lets an authenticated attacker run code as root on the firewall or Panorama. Palo Alto Networks published the advisory on October 14, 2026, reported limited exploitation attempts, and CISA added it to the KEV catalog the same day. Am I affected? PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) on unpatched PAN-OS 10.2, 11.1, 11.2, 12.1 or 12.2. Cloud NGFW and Prisma Access are not affected. Risk is highest if the management interface is reachable from the internet or untrusted networks. Check: Device > Software (or 'show system info') for your PAN-OS version, and compare with the fixed list. Fixed versions (this or later in your branch): - 12.2: 12.2.4 - 12.1: 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 - 11.2: 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16 - 11.1: 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3 - 10.2: 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12 Check the vendor advisory for the latest list before upgrading. Interim mitigation: there is no workaround, but restricting management interface access to a dedicated management network or trusted admin IPs (no internet exposure) and removing unused admin accounts greatly reduces exposure. After upgrading: review admin login and config audit logs since early October for unknown sessions or changes, and rotate admin passwords and API keys if anything looks wrong. Sources: https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/ https://thehackernews.com/2026/10/palo-alto-networks-patches-pan-os.html https://cybersecuritynews.com/pan-os-vulnerability-exploited-cisa-warns/