Palo Alto patches Panorama PAN-OS root code injection CVE-2026-0330
Original title: Palo Alto Networks Patches PAN-OS Vulnerability Allowing Remote Code Execution With Root Privileges
The authenticated flaw affects Panorama on five PAN-OS branches; firewalls, Cloud NGFW, and Prisma Access are unaffected.
Palo Alto Networks published fixes on November 11, 2026, for CVE-2026-0330, a code-injection flaw in PAN-OS running on Panorama. An authenticated administrator with network access can execute arbitrary code with root privileges. The vendor rates it medium severity, with CVSS v4.0 base 8.6 and a threat-adjusted score of 6.1, and says it was unaware of malicious exploitation. No workaround exists; management-access restrictions and Threat Prevention signatures reduce exposure but do not replace the update.
- No special configuration is required for affected Panorama installations to be vulnerable.
- PAN-OS 12.2 is fixed in 12.2.4-h2; other branches have multiple maintenance-train hotfixes.
- Unsupported releases require migration to supported, fixed software.
- Threat IDs 510045 and 510048 in content 9171-10349 and later need SSL Decryption.
Impact: Authenticated administrator can run arbitrary code as root
| Product | Affected | Fixed in |
|---|---|---|
| Palo Alto Networks PAN-OS on Panorama | PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 | 12.2.4-h2; 12.1.4-h14, 12.1.7-h12, 12.1.10-h4; 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2; 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5; 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13,… |
- 1.Install the fixed release for the installed PAN-OS maintenance train, or a later supported version.
- 2.Restrict Panorama management access to trusted internal addresses or a jump box.
- 3.Enable Threat Prevention signatures 510045 and 510048 with SSL Decryption where subscribed.
- CVEs
- CVE-2026-0330
- Vendors
- Palo Alto Networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-0330 | Authenticated root RCE in PAN-OS Panorama | 6.1 | — |
From the original article
2 min read at gbhackers.com
Palo Alto Networks has released fixes for CVE-2026-0330, a remote code execution vulnerability affecting PAN-OS software running on Panorama. The flaw allows an authenticated administrator with network access to execute arbitrary code with root privileges, according to the company’s security advisory, published November 11, 2026. The vendor classifies the issue as medium severity with moderate […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.