Palo Alto PAN-OS RCE Flaw Allows Attackers to Execute Arbitrary Code With Root Privileges

Palo Alto Networks has disclosed a remote code execution vulnerability in PAN-OS software running on Panorama. Tracked as CVE-2026-0330, the flaw allows an authenticated administrator with network access to execute arbitrary code with root privileges.

The November 11, 2026, advisory urges users to patch affected Panorama deployments, while Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls are not impacted.

Palo Alto Networks says it is not aware of malicious exploitation and credits internal researcher Daniel Voce with discovering and reporting the vulnerability. The official security advisory classifies the flaw as CWE-94, a code injection weakness.

Successful exploitation lets an administrator run code with root permissions rather than remain within normal administrative limits. The published assessment identifies high privileges as a requirement and says no user interaction is needed.

No special configuration is required for an affected Panorama installation to be vulnerable. However, exploitation requires both administrator authentication and network access. This is not an unauthenticated attack that anyone on the internet can directly carry out against a reachable system.

Palo Alto Networks PAN-OS RCE Vulnerability

Palo Alto Networks assigns the issue a medium severity rating, with a CVSS threat score of 6.1 and a base score of 8.6. The vendor lists moderate urgency but warns that risk is highest when management access is allowed from external internet addresses.

The flaw is separate from the previously reported PAN-OS root code execution vulnerability CVE-2026-0322. That earlier issue had reported exploitation. Those attacks should not be treated as evidence that attackers are exploiting this newly disclosed Panorama vulnerability.

Fixes cover PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 on Panorama. For the latest maintenance lines listed in each branch, patched releases include 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5, and 10.2.18-h14. Administrators should use the advisory’s upgrade guidance for their installed release.

Additional fixes are available for earlier maintenance lines. PAN-OS 12.1 options include 12.1.4-h14 and 12.1.7-h12. PAN-OS 11.2 options include 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, and 11.2.13-h5. Separate hotfixes also cover older 11.1 and 10.2 maintenance releases.

Unsupported versions should move to a supported, fixed release. No known workaround fixes the underlying issue. Palo Alto Networks recommends limiting management access to trusted internal IP addresses.

Its management security guidelines warn against exposing firewall or Panorama management interfaces to the internet or other untrusted networks.

Restricting access to a dedicated jump box can further reduce exposure. Previous reporting on exposed PAN-OS management interfaces highlights why this boundary deserves attention. Access restrictions reduce risk, but they do not replace the security update.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post Palo Alto PAN-OS RCE Flaw Allows Attackers to Execute Arbitrary Code With Root Privileges appeared first on Cyber Security News.