CVE-2026-0322
validatedZero produced an exploit or a check.GHSA-9fh3-97mp-7wmv ↗EUVD-2026-101495 ↗
check availableZero validated a working check for it.not proven exploitableZero has a detection check, but hasn't produced a full working exploit yet.
cve.orgpublic pocExploit code has been published by someone. Source signals can also carry a PoC (Proof of Concept).+9h50mkevAttacks confirmed in the real world.+2h01m
Palo Alto Networks PAN-OS >= 12.2.0, < 12.2.4; >= 12.1.0, < 12.1.10-h2; >= 11.2.0, < 11.2.16; >= 11.1.0, < 11.1.16-h3; >= 10.2.0, < 10.2.18-h12
fixed in 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12
ETK-2026-1636Zero's internal tracking ID, independent of the CVE number., permanent identifier
+10h31mTTV
18mAI analysisAnalysis: how long the AI spent reversing this signal.
Check if you are vulnerable description
PAN-OS management interfaces on PA-Series and VM-Series firewalls and Panorama deployments are affected. An attacker with valid credentials and network access to the management interface may execute code with root-level privileges.
mitigation
Upgrade PAN-OS to 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, or 10.2.18-h12, as appropriate for the deployed release. Restrict management-interface access to trusted internal IP addresses.
fixed in 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, 10.2.18-h12
check
available
exploit
no
automationDeterministic: a check that runs on its own, the same request on every target. Contextual: an agentic technique that needs to be applied per target, for bugs that depend on contextual flows.
contextual
auth requiredWhether an attacker needs an account first, based on the CVSS vector's Privileges Required.
yes, high privileges
EPSSEstimate of the chance this CVE is exploited in the next 30 days. Refreshed daily.
1.2%68th percentile
agent run time
18m
cve.org record, t = 0The moment cve.org publishes the CVE in full.
2026-10-14 17:26Z
Δ to public pocExploit code has been published by someone. Source signals can also carry a PoC (Proof of Concept).
+9h50m
Δ to kevAttacks confirmed in the real world.
+2h01m
outcome
Contextual check: a technique exists and was validated, but no deterministic check could cover this one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-14vulncheck_kev: trigger signal, started the run
- 2026-10-14 00:00ZCISA Known Exploited Vulnerabilities catalog
- 2026-10-14 00:00Z
- 2026-10-14 17:26Zcve.org record for CVE-2026-0322
- 2026-10-15 06:17ZPalo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
- 2026-10-15 10:17ZIfe-ella/CVE-vulnerability
this entry in the feed
GET /api/v1/feed/CVE-2026-0322
{ "etk_id": "ETK-2026-1636", "cve_id": "CVE-2026-0322", "display_id": "CVE-2026-0322", "ghsa_id": "GHSA-9fh3-97mp-7wmv", "euvd_id": "EUVD-2026-101495", "status": "published", "anchor_state": "anchored", "title": "Authenticated code execution in the PAN-OS management interface", "summary": "PAN-OS management interfaces on PA-Series and VM-Series firewalls and Panorama deployments are affected. An attacker with valid credentials and network access to the management interface may execute code with root-level privileges.", "mitigation": "Upgrade PAN-OS to 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3, or 10.2.18-h12, as appropriate for the deployed release. Restrict management-interface access to trusted internal IP addresses.", "vendor": "Palo Alto Networks", "product": "PAN-OS", "affected": [ { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "Cloud NGFW", "purl": null }, { "affected_notes": [], "affected_ranges": [ ">= 12.2.0, < 12.2.4", ">= 12.1.0, < 12.1.10-h2", ">= 11.2.0, < 11.2.16", ">= 11.1.0, < 11.1.16-h3", ">= 10.2.0, < 10.2.18-h12" ], "ecosystem": null, "fixed_versions": [ "12.2.4", "12.1.10-h2", "11.2.16", "11.1.16-h3", "10.2.18-h12" ], "package_name": "PAN-OS", "purl": null }, { "affected_notes": [], "affected_ranges": [], "ecosystem": null, "fixed_versions": [], "package_name": "Prisma Access", "purl": null } ], "cwes": null, "cvss_score": 8.6, "cvss_src": "other", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red", "epss_score": 0.0122, "epss_percentile": 0.6816, "epss_asof": "2026-10-20", "automation": "contextual", "check": true, "check_confidence_basis": "assessed", "exploit": false, "pipeline_minutes": 18.318630216666666, "t0_at": "2026-10-14T17:26:52.448000+00:00", "signals": { "check": { "at": "2026-10-15T03:57:45.885514+00:00", "days": 0.4381184897453704, "is_lower_bound": false, "measured_at": "2026-10-14T17:26:52.448000+00:00", "url": null }, "kev": { "at": "2026-10-14T19:27:28.010500+00:00", "days": 0.0837449363425926, "is_lower_bound": false, "measured_at": "2026-10-14T17:26:52.448000+00:00", "precision": "exact", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322" }, "public_poc": { "at": "2026-10-15T03:16:30+00:00", "days": 0.4094624074074074, "is_lower_bound": false, "measured_at": "2026-10-14T17:26:52.448000+00:00", "url": "https://github.com/Ife-ella/CVE-vulnerability" }, "trigger_signal": { "at": "2026-10-14T00:00:00+00:00", "days": -0.7269959259259259, "is_lower_bound": false, "measured_at": "2026-10-14T17:26:52.448000+00:00", "url": "https://vulncheck.com/cve/CVE-2026-0322" } } }
published 2026-10-15 03:36Z
last change 2026-10-21 05:00Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.