PAN-OS CVE-2026-0322: CISA gave 3 days, and Palo Alto gives no count for 'very limited' exploitation

3 hours 27 minutes from the vendor's record to the CISA listing, then 3 days

Palo Alto Networks' CVE record for CVE-2026-0322 gives a public date of 14 October 2026 at 16:00 UTC. The catalogue file of the US Cybersecurity and Infrastructure Security Agency (CISA) that first lists the flaw, version 2026.10.14, was released at 19:27 UTC the same day, 3 hours 27 minutes later (derived from the two timestamps). The entry's due date is 17 October, three days after the day it was added. That date is a Saturday, so the deadline falls after two working days (derived). The entry also carries CISA's forensic triage flag, which under the directive means a federal agency must check whether the device is already compromised, not only patch it.

Palo Alto's advisory, published the same day, describes a code injection (CWE-94) in the management interface of PAN-OS, the firewall operating system. It says an authenticated attacker with network access can run arbitrary code as root on the firewall. It applies to PA-Series and VM-Series firewalls and to Panorama, the central management product, in virtual and M-Series form. Cloud NGFW and Prisma Access are not affected. Palo Alto scores it 8.6 (High) on CVSS 4.0, suggests urgency Highest, says no special configuration is needed to be affected, and states: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface."

Two timestamps and a due date describe how quickly two organisations published. They do not establish when exploitation began, how many devices were reached, how the attackers obtained credentials, whether any firewall was taken over or used as a way into a network, what Palo Alto means by "very limited", how many management interfaces are reachable from untrusted networks in practice, or whether the signatures Palo Alto offers as partial protection work. The advisory is silent on each. BleepingComputer says it asked Palo Alto when exploitation began, who is behind it and whether firewalls were compromised, and its article prints no answer. SecurityWeek and The Hacker News describe the same gaps. The first table below sets them out.

Palo Alto sells the firewalls affected and the Threat Prevention subscription whose signatures it offers as limited protection, so the advisory is a vendor's account of a flaw in its own product and everything attributed to it here is its account. CISA's listing does not come from the vendor, but the evidence behind it is not published; CISA's guidance says it adds an entry only on reliable evidence of exploitation in the wild. This briefing reads the advisory, the CVE and NVD records, the CISA catalogue file and directive pages, Palo Alto's guidance and end-of-life pages, three news reports as secondary sources, and the UK pages cited below, between 08:08 and 08:30 BST on Thursday 15 October 2026. Anything that could change within hours, such as the 11.2.16 build, is time-stamped.

This is the third PAN-OS entry the CISA file lists for 2026, after CVE-2026-0300 on 6 May and CVE-2026-0257 on 29 May (derived from the file). The site's earlier briefing on CVE-2026-0257 reports a warning, relayed by Infosecurity Magazine, that ransomware groups still used that flaw 149 days after its advisory. That advisory, dated 13 May, was 154 days before this one (derived). The earlier flaw carries CISA's ransomware flag as Known; for this one it is Unknown.

Stated and not stated: ten questions the advisory leaves open

The table keeps what the primary pages fix apart from what they leave out. "Derived" marks a figure computed here from dates in the sources. Where the only support is a news report, the row says so.

Ten questions about CVE-2026-0322. Sources: Palo Alto advisory and CVE record (14 October 2026), CISA catalogue file 2026.10.14, NVD, FIRST CVSS 4.0 specification, BleepingComputer, SecurityWeek, The Hacker News.

Question	Fixed on the record	Not stated
Is it being exploited?	Palo Alto: very limited exploitation observed; exploit maturity Attacked. CISA lists it in the KEV catalogue and its enrichment entry in the CVE record says exploitation is active.	How many devices, attempts or victims. "Very limited" is not defined.
When did exploitation begin?	Nothing. The CVE ID was reserved on 3 November 2025, 345 days before the public date (derived), and four neighbouring Palo Alto IDs were reserved within about two minutes of it (derived).	Any start date. A reservation date is not a discovery date, and the label zero-day used by BleepingComputer and SecurityWeek is not in the advisory.
Who is behind it?	Palo Alto lists three IP addresses it associates with threat activity (not reproduced here). CISA records ransomware campaign use as Unknown.	Any actor, motive or type of target.
How were credentials obtained?	The advisory says authenticated. Its vector sets privileges required to High, which FIRST defines as significant, for example administrative, control over the vulnerable system.	How the attackers got credentials (FIRST's metric puts that outside its scope), which role, whether MFA was on, whether another flaw was used.
Were firewalls compromised?	By design the flaw gives root on the firewall once exploited.	Whether any device was taken over in the wild, what was done next, or whether a firewall was used to reach an internal network. BleepingComputer asked.
Are management interfaces internet-exposed in practice?	Palo Alto: the risk is highest when the interface is reachable from external addresses on the internet. It recommends trusted internal addresses only.	Any count of exposed interfaces, or whether the targeted ones were exposed.
Do the Threat Prevention signatures work?	Palo Alto: limited coverage of known patterns, variations may exist that cannot currently be detected, four conditions apply including decryption.	A detection rate, a test, or how many attempts the signatures catch.
How does a defender tell whether a device was hit?	Three IP addresses are listed as indicators.	Any device artefact, log source or triage procedure. CISA's entry points to generic triage guidance.
What does root on Panorama mean for managed firewalls?	Panorama is affected. The vector scores subsequent system impact as None.	Anything about managed devices, stored credentials or configuration.
Are older, unsupported versions affected?	For all older unsupported versions the advisory says upgrade to a supported fixed version.	Whether they are vulnerable. The affected list starts at 10.2 and no fixed build is named for them.

Read together, the stated column is short and mostly about the vendor's product, and the unstated column is about the world. That is normal for a day-one advisory, and it is the reason a deadline set by another body, on evidence it has not published, should be read as a prompt to investigate rather than as a measure of how many firewalls were hit.

Five clocks for one flaw, and who each one binds

CISA's due date is not the only deadline a UK security lead meets, and the windows are not like for like. The CISA window binds US federal civilian agencies under Binding Operational Directive 26-04, issued on 10 June 2026. It does not bind UK organisations. The NCSC table is guidance. Cyber Essentials is a certification requirement for in-scope devices, firewalls included. The ICO's 72 hours is a legal clock that starts with awareness of a personal data breach. The table sets them side by side, and the diagram draws them to scale from the CISA catalogue release.

The windows that apply to this flaw. Sources: CISA catalogue file and BOD 26-04 Table 1, NCSC page on responding to active exploitation, Cyber Essentials Requirements for IT Infrastructure v3.3, ICO breach guide.

Clock	Window	What starts it	Who it applies to
CISA KEV entry for this flaw	3 days with forensic triage, due Saturday 17 October	Listing on 14 October, or the agency's own identification if earlier	US federal civilian agencies. Not UK organisations.
BOD 26-04 Table 1, row 11: same flaw, asset not publicly exposed	14 days, no forensic triage	The same event	The same agencies. The row for an exposed asset (row 3) is the 3 days and forensic triage above.
NCSC table: KEV yes, internet accessible yes, automatable no, total control yes	Under 48 hours, plus an investigation by an assured incident-response provider	Not stated on the page	UK organisations, as guidance. The table has three rows and none covers a not-internet-accessible, not-automatable case.
Cyber Essentials v3.3 (April 2026)	Within 14 days of release	Release of the update	Organisations certified under Cyber Essentials, for in-scope firewalls.
ICO, UK GDPR	72 hours where feasible	Becoming aware of a personal data breach	Controllers. A processor must tell the controller without undue delay.

Counted in days, the Cyber Essentials window is 11 days longer than CISA's three and 4.67 times as long (derived). Against the NCSC's under-48-hours row it is seven times as long, 336 hours to 48 (derived). Cyber Essentials counts from the release of the update, and Palo Alto's advisory does not date each build separately. Counted from 14 October the 14 days end on Wednesday 28 October, and from the 11.2.16 build's stated ETA of 15 October they end on Thursday 29 October (derived).

A three-day window carries less signal than it once did. In the CISA file as read, 105 of the 128 entries added since BOD 26-04 took effect on 10 June 2026 have a three-day window, and 84 of them carry the forensic triage flag. Between 1 January and 9 June, 31 of 133 entries had three days (all derived). Under Table 1 the combination that gives three days and forensic triage for this flaw is an exposed asset, a KEV listing, automatable marked no and total control. The window alone does not rank it above the other 83 flagged entries.

The BOD table turns on one fact the sources do not settle: whether the asset is publicly exposed. For this flaw CISA's enrichment record in the CVE data says automatable no and technical impact total. With the asset public, Table 1 gives 3 days and forensic triage (row 3). With it not public, 14 days (row 11), which is 11 days longer (derived). CISA's entry tells agencies to evaluate each asset's internet exposure. Its implementation guidance says that where an agency has not supplied the information, an asset on a publicly routable address, or tagged as a network device, is treated as public. Whether a firewall that faces the internet but has an isolated management interface counts as publicly exposed is not stated on the pages read. The NCSC's table asks a similar question, whether the affected product is accessible via the internet, with the same ambiguity: the product is a firewall, and the vulnerable surface is its management interface. The NCSC page is framed around automated exploitation, and CISA's record for this flaw says it is not automatable. Its table still gives under 48 hours when a listed flaw is exploited, the system is internet accessible and control is total.

Which builds are fixed: 19 of 20 version ranges, with 11.2.14 and 11.2.15 waiting

At 08:30 BST on 15 October the advisory still listed the 11.2.16 build as "ETA: 10/15", and the public PAN-OS 11.2 release-notes page reachable without an account, stamped 25 September, has no build list to confirm it either way. Palo Alto's download portal needs an account and was not tried, so whether any named build can be downloaded could not be confirmed. On the advisory's own table there are five branches (12.2, 12.1, 11.2, 11.1 and 10.2) and 20 version ranges. 19 ranges have a fixed build not flagged as pending, and 1 has only a pending one: 11.2.14 through 11.2.15 (derived). Four branches are fixed for every range, 11.2 for four of its five, and no branch is without a fix.

Fixed builds as the advisory names them, and Palo Alto's support dates. Sources: Palo Alto advisory CVE-2026-0322 and end-of-life summary page, read at 08:30 BST on 15 October 2026.

Branch	Fixed builds named	Palo Alto support dates	State at 08:30 BST
12.2	12.2.4	Standard to 30 July 2029, extended to 30 July 2030	Named, no ETA flag
12.1	12.1.4-h12, 12.1.7-h8, 12.1.10-h2	Standard to 28 August 2028, extended to 28 August 2029	Named, no ETA flag
11.2	11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, and 11.2.16	Standard to 2 May 2027, extended to 31 August 2027	Four builds named. 11.2.16 is flagged ETA 10/15 and is the only fix listed for 11.2.14 and 11.2.15
11.1	11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3	Standard to 3 May 2027, extended to 31 August 2027	Named, no ETA flag
10.2	10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12	Standard ended 27 August 2025, extended to 31 March 2027	Named, no ETA flag

An organisation on 11.2.14 or 11.2.15 is on the newest 11.2 builds and has no named fixed build to move to yet. Palo Alto says no known workarounds exist. Until 11.2.16 appears, the options on the record are to restrict management access and, if its conditions can be met, to enable the Threat Prevention signatures. All five branches appear in Palo Alto's end-of-life table with support dates after today, 10.2 in extended support. For versions older than the five, which are end of life, the advisory says only to upgrade to a supported fixed version.

Four friendly names: authenticated, management interface, limited protection, very limited

Four phrases in the advisory or its coverage do the work of a control or a measurement. None is either.

Four labels and what the record says behind each. Sources: Palo Alto advisory and its linked guidance, FIRST CVSS 4.0 specification, NCSC alert of 18 June 2026.

Label	What it sounds like	What the record says
Authenticated	A lesser flaw: the attacker must already be inside, so ordinary hygiene covers it.	Palo Alto's vector sets privileges required to High, which FIRST defines as significant, for example administrative, control over the system. The flaw takes that to root on the operating system beneath. Credentials are what attackers are known to hold: the NCSC's 18 June 2026 alert on Fortinet firewalls describes a leaked database of credentials for firewall and VPN portals, a different vendor. How credentials were obtained here is not stated.
Management interface	An internal admin page, quiet and low risk.	The most privileged surface of the appliance and, for Panorama, a shared one. Palo Alto scores two cases: 8.6 if reachable from the internet and 8.5 if only from a jump box, so the control it recommends moves the score by 0.1 (derived). The advisory's description links a Palo Alto community post on securing management access, which could not be read (a 403 answer). Its workaround text links the PAN-OS 10.1 best-practice pages, updated 28 August 2023.
Limited protection	A partial control you can switch on today.	Palo Alto writes limited coverage, and the press writes limited protection. Its conditions: route management traffic through a data-plane port, replace the certificate for inbound management traffic, decrypt that traffic, and enable threat prevention on it. The signatures cover known patterns, variations may exist that cannot currently be detected, and Palo Alto's own FAQ recommends upgrading.
Very limited exploitation	A handful of cases.	A size word with no count, period or definition, set beside a suggested urgency of Highest and a CISA listing with a three-day window.

The pattern is a label doing the work of a control. "Authenticated" feels like a barrier, but the barrier is a credential, and credentials are the commonest thing for an attacker to hold. "Management interface" feels internal, but the allow list that protects it is only as strong as every machine and account on it. "Limited protection" feels like a switch, but it is four changes to how management traffic flows, one of which requires decrypting it.

The UK: NCSC guidance, Cyber Essentials, the ICO and the shared admin network

NCSC. No NCSC alert on CVE-2026-0322 was found: the NCSC's news feeds, read at 08:30 BST on 15 October, list nothing after 12 October. The NCSC has issued vendor-specific alerts before, on Palo Alto GlobalProtect on 22 April 2024 and on Fortinet firewalls and VPN gateways on 18 June 2026, so one may follow. This briefing does not assume it. What the NCSC has already published applies without one. Its 27 August 2026 alert on internet-exposed systems and edge devices, written about operational technology, says devices such as firewalls should be within vendor support, routinely updated, and managed only from a segregated management network that is not connected to the internet. It asks for unique administrator accounts, MFA wherever supported, and monitoring for unexpected configuration changes or outbound connections.

The NCSC's page on responding to active exploitation gives the table drawn above. It says that where a full investigation by an assured Cyber Incident Response provider is not possible, the affected system should be erased or destroyed and rebuilt as new before the latest updates and hardening are applied. The Fortinet alert adds two steps that carry over: investigate other edge devices that share credentials with a compromised one, and obtain logs, configurations and other artefacts before any reset, because the reset destroys them.

Forensic observability. The CISA flag assumes a device can be examined. In a blog of 29 July 2026, an NCSC technical director says many network devices still give only limited support for investigating an incident, so that defenders can end up with fewer tools than the attacker, and asks buyers to push vendors for it. The NCSC's 2025 guidance lists what a network device should log, including authentication events with username, method and source address, configuration changes, process creation, firmware updates and attempts to clear logs, delivered off the device in near real time. Because this flaw gives root, logs held only on the device cannot be relied on afterwards (inference). Whether PAN-OS records each item in the NCSC's list, and whether an organisation forwards them, is not in the advisory and has to be checked locally.

Cyber Essentials. Requirements for IT Infrastructure v3.3, April 2026, speaks to this flaw twice. For firewalls it requires that the administrative interface is not reachable from the internet unless there is a clear and documented business need and it is protected by MFA, or by an IP allow list limiting access to a small range of trusted addresses combined with properly managed password authentication. Palo Alto's mitigation, trusted internal addresses only, is the allow-list option. Against a flaw that needs credentials, an allow list is only as strong as the machines and accounts on it, and the advisory does not say whether MFA would have stopped the exploitation it saw. For updates, v3.3 requires fixes within 14 days of release where the vendor describes the vulnerability as critical or high risk, or the CVSS v3 base score is 7 or above. Palo Alto's severity for this flaw is High. NVD, at 08:08 BST, had received the record but not analysed it and shows no CVSS v3 score, so the vendor's label is what applies. From 14 October the window ends on 28 October (derived).

ICO. The ICO's guide says a notifiable personal data breach must be reported within 72 hours of becoming aware of it, where feasible, with details allowed in phases, and that every breach must be recorded whether or not it is reported. A processor must tell the controller without undue delay. On the ICO's wording, a vendor advisory or a KEV entry is not by itself awareness of a breach in a given organisation, and evidence from triage that an unauthorised party reached systems holding personal data would be (a reading, not the ICO's words). Whether root on a firewall reaches personal data depends on what the firewall decrypts, logs and stores, which the advisory does not say. The ICO page points to Article 29 Working Party guidelines on when a controller is aware; this briefing did not read them.

The shared admin network. Many UK organisations, and managed service providers acting for them, manage a fleet of firewalls from one admin network or one Panorama. That is the arrangement the advisory's mitigation relies on: trusted internal IP addresses means every host on that network. For a flaw that needs credentials, each of those hosts and each administrator account is part of the attack surface, and one stolen credential or one compromised jump host may reach every firewall that trusts the network (inference; the advisory does not describe fleets). The PAN-OS 10.1 edition of Palo Alto's administrative access guidance says to authenticate at the bastion host and again at the firewall, to require MFA for all management access, and to keep the mandatory local superuser as the only local account. If a supplier manages your firewalls, ask what it has checked: a processor that learns of a breach must tell you without undue delay. The NCSC's Early Warning service is free to register and says it should not be the only layer of defence.

What to do, in the order worth doing

The order puts knowing what you run and who can reach it first, because every later step depends on it. Preserving evidence comes before the upgrade, because an upgrade can destroy what triage needs.

What could not be verified

• Fixed builds. Whether any named build, including 11.2.16, can be downloaded. The advisory (08:08, 08:11, 08:27 and 08:30 BST) lists 11.2.16 as ETA 10/15, the public 11.2 release-notes page has no build list, and Palo Alto's download portal needs an account and was not tried.
• Exploitation. When it began, how much there was, who is behind it, and how credentials were obtained. Palo Alto does not say, and the three news reports repeat the gap.
• CISA's evidence. The basis for the listing is not published. BOD 26-04's Table 1 is an image on the CISA page and was read as an image.
• Indicators. The three IP addresses were read and are not reproduced.
• Palo Alto community post. The management-access post linked from the advisory's description answered curl with a 403 and was not read; the 10.1 best-practice pages linked from the workaround text were.
• News timing. BleepingComputer's page is stamped 14 October, 06:56 PM, with no time zone. SecurityWeek (15 October, 06:59 UTC) and The Hacker News (15 October, 11:47 at UTC plus 5:30) were read as secondary reports. The Hacker News answered curl with a bot check, which was not bypassed, and was read in a browser tab.
• NCSC. No NCSC alert on this CVE was found in its feeds at 08:30 BST. One may appear later in the day.
• Not read. The Article 29 Working Party guidelines the ICO page cites, and Palo Alto's own instructions for collecting forensic evidence from a PAN-OS device, if any exist.
• NVD. The record was in Received status at 08:08 BST, with no NVD analysis and no CVSS v3 score.
• Time-stamped. Sources were read between 08:08 and 08:30 BST on 15 October 2026. The 11.2.16 build, the KEV entry, the NVD record and the NCSC pages could change within hours.

The question that exposes the gap

Which machines and which accounts can reach the management interface of every firewall you run today, and if one credential among them were already in an attacker's hands, which log, held where the attacker cannot reach it, would show the first command that ran as root?

Key facts