What happened

• Palo Alto Networks confirmed limited active exploitation of CVE-2026-0322, a CVSS 8.6 flaw in the PAN-OS management interface [S1].
• An authenticated attacker with network access to the management interface can execute code as root on PA-Series, VM-Series and Panorama [S1].
• Exploitation requires existing credentials and network access to the management interface [S1].
• The vendor says there are no workarounds beyond Threat Prevention signatures, which give limited coverage [S1].
• Three exploiting IP addresses have been published, and CISA has added the CVE to the KEV catalog [S1].

Timeline

Detect

Published CVE-2026-0322 exploiting IPs in any log · PAN-OS traffic, system and configuration logs; any perimeter, proxy or flow logs

index=* (TERM(208.83.239.114) OR TERM(66.42.72.14) OR TERM(149.248.47.234)) | stats count min(_time) as first_seen max(_time) as last_seen values(sourcetype) as sourcetypes by host | convert ctime(first_seen) ctime(last_seen)

A hit means: One of the three IPs reported as exploiting CVE-2026-0322 touched your environment. If the hit is on a firewall or Panorama management interface, treat it as possible exploitation and verify. A hit elsewhere means only that the IP was seen [S1].

Verify

• Check whether the hit targets the management interface address or port of a PA-Series, VM-Series or Panorama device, rather than traffic passing through the firewall [S1].
• Exploitation needs valid credentials, so look for an admin authentication from the same IP near the hit [S1].
• Benign look-alike: blocked inbound scans from these IPs against data-plane addresses, with no session to the management interface.
• Benign look-alike: matches in threat-intel feed ingestion or blocklist logs that only contain the IP string.

Scope

Affected

• PAN-OS on PA-Series appliances [S1]
• PAN-OS on VM-Series [S1]
• Panorama [S1]

Only if

• The attacker has network access to the management interface [S1]
• The attacker holds valid credentials for it [S1]

Not affected if

None stated by the sources.

Enumerate

• All PA-Series, VM-Series and Panorama instances and their PAN-OS versions
• Management interface addresses, and which are reachable from the internet or untrusted networks
• Admin accounts on each device and Panorama, with their last-login sources
• Whether Threat Prevention signatures are licensed and enabled on each device

Contain

• Preserve evidence first: export system, configuration and traffic logs from affected devices and Panorama before you make changes.
• Restrict management interface access to trusted internal IP addresses only [S1].
• Block 208.83.239.114, 66.42.72.14 and 149.248.47.234 at the perimeter [S1].
• Enable Threat Prevention signatures; coverage is limited [S1].
• Rotate admin credentials on any device whose management interface was exposed, since exploitation needs valid credentials [S1]. Rotation invalidates existing sessions and cannot be undone.

Eradicate

• The sources do not describe post-exploitation persistence. Treat any device with a confirmed hit as root-compromised and follow vendor guidance once it is published.
• Apply the vendor fix when fixed versions are confirmed; the source names none [S1].

Recover

• Before restoring management access, confirm it is limited to trusted internal IPs and that admin credentials have been rotated [S1].
• Validate the running configuration against a known-good backup.
• Afterwards, keep watching for the published IPs and for admin logins from unexpected sources [S1].

Re-enter the loop when

• Palo Alto Networks publishes fixed versions or updates its advisory.
• New exploiting IPs or other IoCs are published.
• Exploitation is reported without credentials, or against other products.
• The KEV entry or the vendor's description of the exploitation scale changes.

Debrief

• Record which devices exposed management interfaces and since when.
• Record how the attackers would have obtained valid credentials; the source does not say.
• Gap: no fixed versions, persistence details or attacker attribution in the sources.
• Gap: the vendor advisory and the KEV entry were not reviewed directly.

Detection coverage — checked automatically

Checked automatically 2026-11-10 07:59Z from public sources: 9 published, 17 nothing found, 0 not machine-checkable, 1 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-0322 — Palo Alto Networks confirms limited exploitation of PAN-OS management-interface RCE CVE-2026-0322. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-0322

http.title:"Panorama"

http.html:"PAN-OS"

ssl:"Palo Alto Networks"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD has not published CPE configurations for these CVEs yet, so only the CVE query is exact; the product queries use the name the campaign gives (PAN-OS, Panorama) and are replaced by NVD's spelling at the daily re-check once it names the software.

Also tried under the name the card uses, nothing matched on Shodan: product:"PAN-OS", http.component:"PAN-OS", product:"Panorama", http.component:"Panorama", host.services: (software.product = "PAN-OS"), host.services: (software.product = "Panorama").

Banner spellings: a model read 4 from the NVD names and this card's text (former and marketing names, console titles); 3 matched something on Shodan and are shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 07:59Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Which PAN-OS versions are affected, and which versions contain the fix?
• When exactly did CISA add CVE-2026-0322 to KEV, and what is the remediation due date?
• Does the vendor advisory describe persistence or post-exploitation activity?
• How did the attackers obtain credentials in the observed attacks?
• Do Cloud NGFW or Prisma Access fall within scope? The source names only PA-Series, VM-Series and Panorama.

Sources

• [S1] https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/ · BleepingComputer

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.