An authenticated remote code execution flaw in the PAN-OS management interface lets an attacker with network access run code as root on your firewall. Palo Alto Networks confirmed very limited exploitation in the wild, CISA put it on the Known Exploited Vulnerabilities list on October 14, and federal agencies must remediate by October 17. This free 30-second self-test tells you if you're at risk. No signup, nothing installed.
Check your PAN-OS version — in the web UI: Device → Software — or on the CLI:
show system info | match sw-version
Check whether your management interface is reachable from untrusted networks — the exploit needs network access to the management interface. In the web UI: Network → Interfaces → Management → check the Permitted IP Addresses list. Then check from outside:
nmap -p 443 <your-mgmt-ip>
Check for signs of past compromise — Palo Alto released three attacker IP addresses in its advisory. Hunt your authentication logs for logins from unknown or foreign IPs, especially any administrative logins outside change windows:
Monitor → Logs → System — filter for admin authentication events since early October. Look for logins at odd hours, new admin accounts, or configuration commits nobody on your team made.
This page checked one CVE. BreachHunter tracks attacker infrastructure and exposed management interfaces across your footprint — the exact attack surface this CVE lives on.