Palo Alto Networks PAN-OS Code Injection Vulnerability Added to CISA KEV

What's on the official record

CISA added CVE-2026-0322, a code injection vulnerability in Palo Alto Networks PAN-OS, to the Known Exploited Vulnerabilities Catalog. The CVE record describes a code injection vulnerability (CWE-94) that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

14 October — dateAdded, with a 17 October dueDate. CISA's remediation due date for federal civilian agencies is 2026-10-17. The catalog version is 2026.10.21. The record names the fixed versions as fixed in 12.2.4 and fixed in 12.1.10-h2. The catalog does not record known ransomware use.

FIRST's EPSS model estimate is 0.012 (68th percentile, 2026-10-23). CISA's ADP SSVC assessment records exploitation as active, automatable as no, and impact as total.

Assessment

For a platform or AI-stack owner, the record lets you check whether any PAN-OS instance in your estate runs a version below 12.2.4 or below 12.1.10-h2, and decide whether to patch to those fixed versions or isolate the affected firewall until it is patched. The record attributes the fix to the CVE record, so the decision to patch or isolate rests on the versions you can confirm in your own inventory.

For a cyber underwriter, the record lets you check whether a policyholder's PAN-OS estate is at or above the fixed versions 12.2.4 and 12.1.10-h2, and decide whether to require a control or price the exposure accordingly. The record names no fixed version beyond those two, and the catalog does not record known ransomware use, so the underwriting decision turns on the versions the policyholder can evidence.

What would change this call

A vendor advisory naming additional affected or fixed versions would change the patch and underwriting scope. A change in the catalog's ransomware field, or a CISA update to the SSVC assessment, would change the exposure judgment.

What to check next

Confidence

Filed 25 October 2026 from the record dated 14 October 2026.

Sources

[1] Palo Alto Networks PAN-OS Code Injection Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-0322

[2] CVE record CVE-2026-0322 — https://www.cve.org/CVERecord?id=CVE-2026-0322

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog