{"id":6148,"date":"2026-10-15T12:49:18","date_gmt":"2026-10-15T17:49:18","guid":{"rendered":"https:\/\/cert.pa\/?p=6148"},"modified":"2026-10-15T12:49:19","modified_gmt":"2026-10-15T17:49:19","slug":"csirt-panama-aviso-2026-oct-15-vulnerabilidad-alta-en-palo-alto-networks-pan-os-que-permite-ejecucion-remota-de-codigo-como-root-cve-2026-0322","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=6148","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2026-oct-15: Vulnerabilidad Alta en Palo Alto Networks PAN-OS que permite ejecuci\u00f3n remota de c\u00f3digo como root \u2014 CVE-2026-0322"},"content":{"rendered":"\n

Fecha de emisi\u00f3n:<\/strong> 15 de octubre de 2026
CVE ID:<\/strong> CVE-2026-0322
Severidad:<\/strong> ALTA \u2014 CVSS 4.0: 8.6 (urgencia sugerida por el fabricante: M\u00c1XIMA)
Vector CVSS:<\/strong> CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:H\/UI:N\/VC:H\/VI:H\/VA:H\/SC:N\/SI:N\/SA:N\/E:A\/AU:N\/R:U\/V:D\/RE:M\/U:Red
Tipo de vulnerabilidad:<\/strong> CWE-94: Inyecci\u00f3n de c\u00f3digo
Producto afectado:<\/strong> Palo Alto Networks PAN-OS (firewalls PA-Series, VM-Series y Panorama virtual y M-Series)
Explotaci\u00f3n activa:<\/strong> S\u00ed \u2014 Incluida en el cat\u00e1logo CISA KEV (Known Exploited Vulnerabilities) desde el 14 de octubre de 2026
Fuente:<\/strong> Palo Alto Networks PSIRT \/ NVD \/ CISA \/ Help Net Security \/ INCIBE-CERT \u00b7 avisos \/ The Hacker News
Clasificaci\u00f3n TLP:<\/strong> TLP:CLEAR (Difusi\u00f3n p\u00fablica)<\/p>\n\n\n\n

I. Descripci\u00f3n<\/strong><\/p>\n\n\n\n

Se ha identificado una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en la interfaz de administraci\u00f3n de Palo Alto Networks PAN-OS, registrada como CVE-2026-0322 y calificada con 8.6 de 10 en la escala CVSS 4.0. Un atacante autenticado con acceso de red a la interfaz de administraci\u00f3n podr\u00eda ejecutar c\u00f3digo arbitrario con privilegios de root en el firewall.<\/p>\n\n\n\n

El riesgo es m\u00e1ximo cuando la interfaz de administraci\u00f3n es accesible desde direcciones IP de Internet, y se reduce considerablemente si su acceso est\u00e1 limitado a direcciones internas de confianza o a un \u00fanico equipo de salto (jump box). No se requiere ninguna configuraci\u00f3n especial para estar expuesto.<\/p>\n\n\n\n

El 14 de octubre de 2026, la Agencia de Ciberseguridad y Seguridad de Infraestructura de Estados Unidos (CISA) la incorpor\u00f3 a su cat\u00e1logo de Known Exploited Vulnerabilities (KEV). Palo Alto Networks informa que ha observado una explotaci\u00f3n muy limitada dirigida a la interfaz de administraci\u00f3n.<\/p>\n\n\n\n

Descripci\u00f3n t\u00e9cnica publicada en NVD (en ingl\u00e9s): \u00abA remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS\u00ae software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma\u00ae Access are not impacted by this vulnerability.\u00bb<\/p>\n\n\n\n

II. Productos Afectados<\/strong><\/p>\n\n\n\n

Producto<\/th>Versiones afectadas<\/th>Versi\u00f3n corregida<\/th><\/tr><\/thead>
PAN-OS 12.2<\/td>12.2.0 a 12.2.3<\/td>12.2.4 o posterior<\/td><\/tr>
PAN-OS 12.1<\/td>Anteriores a 12.1.4-h12, 12.1.7-h8 y 12.1.10-h2 (seg\u00fan rama)<\/td>12.1.4-h12, 12.1.7-h8 o 12.1.10-h2 o posterior<\/td><\/tr>
PAN-OS 11.2<\/td>Anteriores a 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 y 11.2.16 (seg\u00fan rama)<\/td>11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3 o 11.2.16 o posterior (11.2.16 con disponibilidad estimada el 15\/10\/2026)<\/td><\/tr>
PAN-OS 11.1<\/td>Anteriores a 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 y 11.1.16-h3 (seg\u00fan rama)<\/td>11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 o 11.1.16-h3 o posterior<\/td><\/tr>
PAN-OS 10.2<\/td>Anteriores a 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 y 10.2.18-h12 (seg\u00fan rama)<\/td>10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 o 10.2.18-h12 o posterior<\/td><\/tr>
Versiones de PAN-OS sin soporte<\/td>Todas<\/td>Migrar a una versi\u00f3n con soporte y corregida<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

No afectados: Cloud NGFW y Prisma Access.<\/p>\n\n\n\n

III. Acciones Requeridas<\/strong><\/p>\n\n\n\n

1. Actualizar inmediatamente<\/strong>
Aplicar la versi\u00f3n corregida de PAN-OS que corresponda a la rama instalada, seg\u00fan la tabla anterior y el aviso del fabricante.<\/p>\n\n\n\n

2. Restringir el acceso a la interfaz de administraci\u00f3n<\/strong>
No existen soluciones alternativas. Mientras se aplica la actualizaci\u00f3n, impedir el acceso a la interfaz de administraci\u00f3n desde Internet y limitarlo a direcciones IP internas de confianza o a un equipo de salto dedicado, conforme a las buenas pr\u00e1cticas del fabricante.<\/p>\n\n\n\n

3. Activar firmas de Threat Prevention (protecci\u00f3n parcial)<\/strong>
Los clientes con suscripci\u00f3n Threat Prevention pueden habilitar los Threat ID 510046 y 510047 (contenido Applications and Threats 9159-10287 o posterior). Para que surtan efecto se debe enrutar el tr\u00e1fico de administraci\u00f3n a trav\u00e9s de un puerto de datos (perfil de administraci\u00f3n en una interfaz DP), reemplazar el certificado de administraci\u00f3n entrante, descifrar ese tr\u00e1fico (requiere SSL Decryption) y aplicar Threat Prevention sobre \u00e9l. La cobertura es limitada y no sustituye la actualizaci\u00f3n.<\/p>\n\n\n\n

4. Verificar posible compromiso<\/strong>
El parche cierra el vector de explotaci\u00f3n, pero no elimina un acceso que el atacante ya haya obtenido. Buscar en los registros del firewall, de Panorama y de los equipos perimetrales conexiones hacia o desde las siguientes direcciones IP, asociadas por Palo Alto Networks a intentos de explotaci\u00f3n de esta vulnerabilidad:<\/p>\n\n\n\n

    \n
  • 66[.]42[.]72[.]14<\/li>\n\n
  • 208[.]83[.]239[.]114<\/li>\n\n
  • 149[.]248[.]47[.]234<\/li>\n<\/ul>\n\n\n\n

    Revisar tambi\u00e9n la actividad administrativa inusual desde antes de la actualizaci\u00f3n (cuentas o sesiones administrativas nuevas, cambios de configuraci\u00f3n no autorizados, procesos o conexiones salientes no habituales) y reportar cualquier hallazgo a incidentes@cert.pa.<\/p>\n\n\n\n

    IV. Referencias<\/strong><\/p>\n\n\n\n

      \n
    • Palo Alto Networks. CVE-2026-0322 PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface. https:\/\/security.paloaltonetworks.com\/CVE-2026-0322<\/li>\n\n
    • National Institute of Standards and Technology (NIST). National Vulnerability Database: CVE-2026-0322. https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-0322<\/li>\n\n
    • CISA. Known Exploited Vulnerabilities Catalog. https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog<\/li>\n\n
    • Help Net Security. CISA flags exploited flaws in Palo Alto, Cisco and Ahsay products. https:\/\/www.helpnetsecurity.com\/2026\/10\/15\/cve-2026-0322-cve-2026-76519-cve-2026-105133-cve-2026-105134-exploted\/<\/li>\n\n
    • INCIBE-CERT \u00b7 avisos. Inyecci\u00f3n de c\u00f3digo en PAN-OS de Palo Alto Networks. https:\/\/www.incibe.es\/incibe-cert\/alerta-temprana\/avisos\/inyeccion-de-codigo-en-pan-os-de-palo-alto-networks<\/li>\n\n
    • The Hacker News. Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation. https:\/\/thehackernews.com\/2026\/10\/palo-alto-networks-patches-pan-os.html<\/li>\n<\/ul>\n\n\n\n

      V. Informaci\u00f3n de Contacto<\/strong><\/p>\n\n\n\n

      CSIRT PANAMA \u00b7 Computer Security Incident Response Team
      Autoridad Nacional para la Innovaci\u00f3n Gubernamental
      E-Mail: incidentes@cert.pa \u00b7 info@cert.pa
      Phone: +507 520-CERT (2378) \u00b7 Web: https:\/\/cert.pa \u00b7 X: @CSIRTPanama \u00b7 Key ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"

      Fecha de emisi\u00f3n: 15 de octubre de 2026CVE ID: CVE-2026-0322Severidad: ALTA \u2014 CVSS 4.0: 8.6 (urgencia sugerida por el fabricante: […]<\/p>\n","protected":false},"author":5,"featured_media":6151,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4],"tags":[76,72,211,68],"class_list":["post-6148","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad","tag-actualizaciones","tag-avisos-de-seguridad","tag-palo-alto","tag-vulnerabilidades","severidad-alto"],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/6148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6148"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/6148\/revisions"}],"predecessor-version":[{"id":6150,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/6148\/revisions\/6150"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/6151"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}