Palo Alto PAN-OS Buffer Overflow Lets Attackers Execute Arbitrary Code as Root
Palo Alto Networks fixed CVE-2026-0310, a CVSS 9.2 unauthenticated PAN-OS buffer overflow enabling root code execution on PA-Series firewalls.
Palo Alto Networks published an advisory on September 9, 2026 for CVE-2026-0310, a CWE-787 out-of-bounds write in PAN-OS XML processing with a CVSS v4.0 base score of 9.2, affecting the management and dataplane interfaces. Unauthenticated attackers could execute arbitrary code as root on PA-Series hardware firewalls, while VM-Series faces denial-of-service impact and Prisma Access and Cloud NGFW have reduced, authenticated exposure. Affected releases include PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 before fixed maintenance releases such as 12.2.3, 12.1.4-h10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10; no workaround is available. Palo Alto is not aware of malicious exploitation but classifies remediation urgency as highest.
- CVE-2026-0310 (CWE-787, CVSS 9.2) stems from unsafe XML handling and needs no special configuration or authentication.
- PA-Series firewalls face root-level code execution; VM-Series limited to denial of service; Prisma Access needs authentication.
- Affected branches: PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2, with fixed releases across all trains.
- No workaround exists; Palo Alto recommends restricting management access to trusted IPs or a dedicated jump box.
- No malicious exploitation observed so far, but unauthenticated root RCE on perimeter firewalls warrants urgent patching.
- CVEs
- CVE-2026-0310
- Vendors
- Palo Alto Networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-0310 | Buffer Overflow in PAN-OS XML Processing Enables Root RCE on PA-Series Firewalls | 7.2 | — |
From the original article
2 min read at gbhackers.com
Palo Alto Networks has announced a high-severity buffer overflow vulnerability in PAN-OS that may allow unauthenticated, network-based attackers to execute arbitrary code with root privileges on affected PA-Series hardware firewalls. This vulnerability is tracked as CVE-2026-0310 and stems from PAN-OS XML processing. It impacts both the firewall management web interfaces and the dataplane interfaces.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.