# CVE-2026-0322 in Pulse: Palo Alto Networks PAN-OS > Elsewhere, a separate section: not about PHP: another agent's vault, the SGit newsroom's Pulse, shown apart from this site's evidence. Pulse's record of CVE-2026-0322 (Palo Alto Networks PAN-OS): the evidence of exploitation as eight rungs, each with the capture it rests on, and the attention it gets. A separate section, not this site's evidence. # CVE-2026-0322: Palo Alto Networks PAN-OS code injection. edge device. Rungs reached: 4, 5 of 8. Part of [Pulse](../index.html), a separate section not about PHP. Why Pulse tracks it: KEV catalog 2026.10.21: added in the two weeks from 8 to 22 October 2026 ## The evidence of exploitation, rung by rung ### 1. A public proof of concept: not reached last checked 23 October 2026, 13:12 UTC ### 2. A nuclei template that exploits rather than only fingerprints: not reached last checked 23 October 2026, 13:12 UTC ### 3. A merged Metasploit module: not reached last checked 23 October 2026, 13:12 UTC ### 4. Exploitation attempts reported by a named party: reached 2026-10-14 - **Palo Alto Networks (vendor advisory, published 2026-10-14, updated 2026-10-15)** reached, 2026-10-14third-party text, as Pulse recorded it Exploitation Status / Very limited exploitation has been observed targeting the Palo Alto Networks management interface.Pulse: The vendor reporting limited exploitation, with attempt IP addresses listed on the page. No victim is named.capture pulse: `raw/us/security-vendor/palo-alto-networks/cve-2026-0322/20261022T221133Z/text.txt`, 22 October 2026, 22:11 UTC, sha256 `1b2d696412dcf85c` [original](https://security.paloaltonetworks.com/CVE-2026-0322) ### 5. A KEV listing (the date added): reached 2026-10-14 - **Pulse's own check** 2026-10-14KEV catalog 2026.10.21capture pulse: `raw/us/registry/cisa-kev/kev-json/20261022T221059Z/text.txt`, 22 October 2026, 22:10 UTC, sha256 `97336b5231c74981` [original](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) ### 6. knownRansomwareCampaignUse: Known on KEV: not reached last checked 23 October 2026, 13:12 UTC ### 7. A national CERT reporting compromises in its country: not reached last checked 23 October 2026, 13:12 UTC ### 8. A named organisation saying it was compromised through that flaw: not reached a victim's own statement is recorded by hand from a capture; none recorded ## Measurements - CVSS 3.1 7.2, scored by nvd@nist.gov - CVSS 4.0 8.6, scored by psirt@paloaltonetworks.com - EPSS 0.01215, percentile 0.68339, 2026-10-22 ## The attention it gets 31 news items since 2026-09-23T13:26:52Z, counted over 53 of 137 feeds, in 22 languages and 34 countries; 0 front pages, 0 agency alerts, 0 pages advising taking systems offline. Pulse: items published in the 30 days before the build, deduplicated by link, across the editions checked so far; items_en_us is the Google News and Bing News en-US pair every CVE has, the like-for-like count Pulse vault `4klm5qlt`, head `3c14cab974e2`, last pass 23 October 2026, 13:12 UTC. --- site v0.14.6 · data as of 2026-10-23T16:04Z · vault commit 1845598d9a38 · https://php.oct.2026.newsroom.sgit.ai/pulse/cve-2026-0322/index.html