PAN-OS Panorama flaw lets admins run code as root (CVE-2026-0330)
Original title: Palo Alto PAN-OS RCE Flaw Allows Attackers to Execute Arbitrary Code With Root Privileges
Palo Alto rates it medium, knows of no attacks, and says Cloud NGFW, Prisma Access, and standalone firewalls are unaffected.
Palo Alto Networks disclosed CVE-2026-0330, a CWE-94 code-injection flaw in PAN-OS on Panorama. An authenticated administrator with network access can execute arbitrary code with root privileges; no special configuration or user interaction is required. The vendor is not aware of malicious exploitation and credits internal researcher Daniel Voce. Patches cover several PAN-OS branches; there is no workaround, though management access should be limited to trusted addresses.
Unconfirmed: Palo Alto says it is not aware of exploitation; that absence is not independently confirmed.
- CVSS base score is 8.6 and the threat score is 6.1.
- Latest patched lines include 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5, and 10.2.18-h14.
- Additional hotfixes cover earlier 12.1, 11.2, 11.1, and 10.2 maintenance releases.
- The vendor says this is separate from exploited CVE-2026-0322.
- Risk is highest when management interfaces are reachable from the internet.
Impact: Authenticated admin can execute arbitrary code as root
| Product | Affected | Fixed in |
|---|---|---|
| Palo Alto Networks PAN-OS on Panorama | 12.2, 12.1, 11.2, 11.1, and 10.2 | 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5, 10.2.18-h14 |
- 1.Upgrade affected Panorama releases using the advisory’s listed hotfixes.
- 2.Restrict management access to trusted internal addresses or a jump box.
- 3.Move unsupported PAN-OS versions to a supported fixed release.
- CVEs
- CVE-2026-0330
- Vendors
- Palo Alto Networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-0330 | Authenticated root RCE in PAN-OS Panorama | 6.1 | — |
From the original article
2 min read at cybersecuritynews.com
Palo Alto Networks has disclosed a remote code execution vulnerability in PAN-OS software running on Panorama. Tracked as CVE-2026-0330, the flaw allows an authenticated administrator with network access to execute arbitrary code with root privileges. The November 11, 2026, advisory urges users to patch affected Panorama deployments, while Cloud NGFW, Prisma Access, and standalone PAN-OS […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.