Palo Alto PAN-OS Vulnerability Enables Arbitrary Code Execution as Root User
Palo Alto Networks patched CVE-2026-0310, an unauthenticated XML-processing buffer overflow in PAN-OS allowing root code execution on PA-Series firewalls.
Palo Alto Networks disclosed CVE-2026-0310, an out-of-bounds write (CWE-787) in PAN-OS XML processing with a CVSS-B base score of 9.2 and CVSS-BT of 7.2. An unauthenticated attacker with network access to a vulnerable management or dataplane interface can send crafted XML to execute arbitrary code as root on PA-Series appliances. On VM-Series the impact is limited to denial-of-service, while Prisma Access and Cloud NGFW require authentication and carry lower risk. Fixed releases include 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10; no workaround exists beyond restricting management interface access.
- Unauthenticated remote attacker gains root code execution via crafted XML on management or dataplane interfaces
- CVSS-B base score 9.2 and CVSS-BT 7.2; classified as CWE-787 out-of-bounds write
- VM-Series exploitation limited to denial-of-service; Prisma Access and Cloud NGFW require authentication
- Fixed in 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10; no workaround available
- Vendor found the flaw internally; no known exploitation in the wild as of September 9, 2026
- CVEs
- CVE-2026-0310
- Vendors
- Palo Alto Networks
- Organizations
- Palo Alto Networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-0310 | Buffer Overflow in PAN-OS XML Processing Enables Root RCE on PA-Series Firewalls | 7.2 | — |
From the original article
2 min read at cybersecuritynews.com
Palo Alto Networks has disclosed a high-severity PAN-OS vulnerability that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on affected PA-Series hardware firewalls. Tracked as CVE-2026-0310, the flaw exists in XML processing, and the vendor has assigned it the highest suggested urgency. The vulnerability is a buffer overflow, classified as […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.