What happened

On October 14, 2026, Palo Alto Networks published an advisory titled "PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface." It says the flaw "enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall." It affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Palo Alto says "Cloud NGFW and Prisma® Access are not impacted by this vulnerability." No special configuration is needed to be affected. Palo Alto rates it CVSS v4.0 8.6, and NVD scores it CVSS 3.1 7.2. Both scores assume the attacker already holds high privileges.

The flaw was found internally at Palo Alto, but by the time of the fix it was already being used: "Very limited exploitation has been observed targeting the Palo Alto Networks management interface." The advisory lists three IP addresses associated with the attempts: 66.42.72.14, 208.83.239.114 and 149.248.47.234. Palo Alto has not said who is behind the attacks or when they began, according to BleepingComputer and SecurityWeek, and no public proof of concept has been reported. CISA added the CVE to the KEV catalog on October 14, alongside a Cisco Secure Email Gateway path traversal and two Ahsay AhsayCBS flaws.

Why it matters if you run public infrastructure

Needing a login sounds like a high bar, but it is not much protection on its own. Firewall admin passwords get phished, reused and left at defaults, and a management interface open to the internet lets anyone who has one try it. Once in, this flaw turns an admin session into root on the device that enforces the rest of your network policy. Palo Alto's own guidance is blunt: "The risk is highest when you allow access to the management interface from external IP addresses on the internet." It is the same lesson as earlier attacks on the PAN-OS management interface, such as CVE-2024-0012 in November 2024. The interface was never meant to be public, and the firewalls that get hit are the ones where it is.

What to check this week

  1. Find out where your management interfaces are reachable from. Check every firewall and Panorama, including any lab, DR or migration appliances, and confirm the management interface does not answer on internet-facing addresses.
  2. Restrict access now. Palo Alto's mitigation is to limit the management interface to trusted internal IP addresses, or to a jump box that is the only system allowed to reach it. There is no workaround in the software itself.
  3. Check the version with show system info on the CLI and upgrade. Fixed releases: 12.2.4; 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2; 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 or 11.2.16; 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 or 11.1.16-h3; 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12. Pick the hotfix on your maintenance line or a later one. Unsupported versions need to move to a supported fixed release.
  4. If you have Threat Prevention, consider Threat IDs 510046 and 510047 (content version 9159-10287 and later). Palo Alto calls this "limited coverage." It only works if management traffic is routed through a data-plane port and decrypted, and Palo Alto still recommends upgrading.
  5. Review admin access. Search management logs for connections from the three IP addresses above. Since exploitation needs a privileged login, also look for admin sign-ins you cannot explain, remove stale admin accounts, and rotate admin passwords on any firewall whose management interface was exposed. This last step is our recommendation, not Palo Alto's.

How Attack Surface Scan covers this

Attack Surface Scan recognizes Palo Alto firewalls from the GlobalProtect portal sign-in page on hosts under your verified domains, including hosts found through certificate transparency logs. PAN-OS does not show its version to anonymous visitors, so on those hosts we raise a potential match for KEV-listed PAN-OS CVEs like this one, capped at medium severity and tagged potential, with instructions for checking the real version. This flaw is in the management interface, not the GlobalProtect portal, and the scan does not identify an exposed PAN-OS management interface specifically. It does list the open ports and web services on each host, which is where one would appear. We do not log in or send exploit traffic. See Vulnerability matching for the details.

Sources