Is CVE-2026-0320 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0320 being exploited in the wild.

How severe is CVE-2026-0320?

Informational severity, published 14 October 2026.

Which products and versions are affected?

Palo Alto Networks PAN-OS 10.2.0-10.2.7, 10.2.8-10.2.10, 10.2.11-10.2.13, 10.2.14-10.2.16, 10.2.17-10.2.18; 11.1.0-11.1.4, 11.1.5-11.1.6, 11.1.7, 11.1.8-11.1.10, 11.1.11-11.1.13, 11.1.14-11.1.16; 11.2.0-11.2.4, 11.2.5-11.2.7, 11.2.8-11.2.10, 11.2.11-11.2.13, 11.2.14-11.2.15; 12.1.2-12.1.4, 12.1.5-12.1.7, 12.1.8-12.1.10; 12.2.0-12.2.3; Palo Alto Networks Panorama 10.2.0-10.2.7, 10.2.8-10.2.10, 10.2.11-10.2.13, 10.2.14-10.2.16, 10.2.17-10.2.18; 11.1.0-11.1.4, 11.1.5-11.1.6, 11.1.7, 11.1.8-11.1.10, 11.1.11-11.1.13, 11.1.14-11.1.16; 11.2.0-11.2.4, 11.2.5-11.2.7, 11.2.8-11.2.10, 11.2.11-11.2.13, 11.2.14-11.2.15; 12.1.2-12.1.4, 12.1.5-12.1.7, 12.1.8-12.1.10; 12.2.0-12.2.3.

How is CVE-2026-0320 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-0320?

Check whether you run Palo Alto Networks PAN-OS or Palo Alto Networks Panorama at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0320: Palo Alto Networks PAN-OS authenticated admin command injection

CVE-2026-0320 · Severity: info · Published 2026-10-14

Palo Alto Networks PAN-OS is a firewall operating system used to protect enterprise networks. An authenticated administrator can inject commands to bypass system restrictions and execute arbitrary code as root, compromising the firewall and the networks it protects. The vulnerability requires administrator access to the management interface, limiting exposure for properly secured deployments.

Technologies: Palo Alto Networks PAN-OS, Palo Alto Networks Panorama. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0320 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0320 being exploited in the wild.
How severe is CVE-2026-0320?: Informational severity, published 14 October 2026.
Which products and versions are affected?: Palo Alto Networks PAN-OS 10.2.0-10.2.7, 10.2.8-10.2.10, 10.2.11-10.2.13, 10.2.14-10.2.16, 10.2.17-10.2.18; 11.1.0-11.1.4, 11.1.5-11.1.6, 11.1.7, 11.1.8-11.1.10, 11.1.11-11.1.13, 11.1.14-11.1.16; 11.2.0-11.2.4, 11.2.5-11.2.7, 11.2.8-11.2.10, 11.2.11-11.2.13, 11.2.14-11.2.15; 12.1.2-12.1.4, 12.1.5-12.1.7, 12.1.8-12.1.10; 12.2.0-12.2.3; Palo Alto Networks Panorama 10.2.0-10.2.7, 10.2.8-10.2.10, 10.2.11-10.2.13, 10.2.14-10.2.16, 10.2.17-10.2.18; 11.1.0-11.1.4, 11.1.5-11.1.6, 11.1.7, 11.1.8-11.1.10, 11.1.11-11.1.13, 11.1.14-11.1.16; 11.2.0-11.2.4, 11.2.5-11.2.7, 11.2.8-11.2.10, 11.2.11-11.2.13, 11.2.14-11.2.15; 12.1.2-12.1.4, 12.1.5-12.1.7, 12.1.8-12.1.10; 12.2.0-12.2.3.
Is there a fix for CVE-2026-0320?: Yes: fixed in PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12. Until then: Restrict access to the management interface to only trusted internal IP addresses and a limited group of administrators. Use a jump box as the single point of access to the management interface to prevent exploitation even if administrator credentials are compromised. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0320 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-0320?: Check whether you run Palo Alto Networks PAN-OS or Palo Alto Networks Panorama at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12

Restrict access to the management interface to only trusted internal IP addresses and a limited group of administrators. Use a jump box as the single point of access to the management interface to prevent exploitation even if administrator credentials are compromised.

Technical details

A command injection flaw in PAN-OS enables authenticated administrators to bypass system restrictions and run arbitrary commands with root privileges via the management interface. The attack requires valid admin credentials and network access to the management interface (network-based attack vector). Palo Alto Networks has published fixes for affected versions across PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 release branches.

Affected products

Palo Alto Networks PAN-OS 10.2.0-10.2.7, 10.2.8-10.2.10, 10.2.11-10.2.13, 10.2.14-10.2.16, 10.2.17-10.2.18; 11.1.0-11.1.4, 11.1.5-11.1.6, 11.1.7, 11.1.8-11.1.10, 11.1.11-11.1.13, 11.1.14-11.1.16; 11.2.0-11.2.4, 11.2.5-11.2.7, 11.2.8-11.2.10, 11.2.11-11.2.13, 11.2.14-11.2.15; 12.1.2-12.1.4, 12.1.5-12.1.7, 12.1.8-12.1.10; 12.2.0-12.2.3
Palo Alto Networks Panorama 10.2.0-10.2.7, 10.2.8-10.2.10, 10.2.11-10.2.13, 10.2.14-10.2.16, 10.2.17-10.2.18; 11.1.0-11.1.4, 11.1.5-11.1.6, 11.1.7, 11.1.8-11.1.10, 11.1.11-11.1.13, 11.1.14-11.1.16; 11.2.0-11.2.4, 11.2.5-11.2.7, 11.2.8-11.2.10, 11.2.11-11.2.13, 11.2.14-11.2.15; 12.1.2-12.1.4, 12.1.5-12.1.7, 12.1.8-12.1.10; 12.2.0-12.2.3

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.