PAN-OS CVE-2026-0322 - Unexpected Shell Child of Management Web Service
Detects shell or interpreter processes spawned as children of the PAN-OS management web service. Exploitation of CVE-2026-0322 (authenticated RCE, CWE-94) in the management interface results in the web server process forking unexpected /bin/sh, curl, wget or scripting interpreter children to run post-exploitation commands on the management plane.
YARA-L
