Palo Alto Networks Patches Critical PAN-OS RCE Vulnerability Affecting Panorama
Palo Alto Networks has released patches for CVE-2026-0330, a critical vulnerability in PAN-OS affecting Panorama deployments that allows authenticated administrators to execute arbitrary code with root privileges.
Palo Alto Networks has issued a critical security advisory for a remote code execution (RCE) vulnerability affecting its PAN-OS software, specifically within Panorama deployments. The flaw, identified as CVE-2026-0330, permits an authenticated administrator with network access to execute arbitrary code with the highest level of root privileges on the affected system.
The vulnerability requires an attacker to possess administrator credentials and network access to the target Panorama instance. While this limits the attack surface compared to unauthenticated flaws, it remains a significant risk for organizations managing their network infrastructure through Panorama. Palo Alto Networks has stated that it is not aware of any active exploitation of this vulnerability in the wild, but strongly urges customers to apply the available patches promptly.
According to the vendor's advisory, the vulnerability is classified under CWE-94, a code injection weakness. Successful exploitation would allow an attacker to bypass normal administrative limitations and execute commands with root permissions. The official assessment notes that while administrator authentication and network access are prerequisites, no user interaction is necessary once these conditions are met. Furthermore, no special configuration is needed for a Panorama installation to be vulnerable.
Palo Alto Networks has assigned a medium severity rating to this vulnerability, with a CVSS v3.1 base score of 8.6 and a threat score of 6.1. The vendor highlights that the risk is amplified when management access is exposed to external internet addresses. This vulnerability is distinct from CVE-2026-0322, a previously disclosed PAN-OS RCE flaw that had seen active exploitation, and the vendor cautions against assuming this new vulnerability is also being exploited.
Patches are available for a range of PAN-OS versions, including 12.2, 12.1, 11.2, 11.1, and 10.2, specifically for Panorama deployments. Key patched releases include 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5, and 10.2.18-h14, among others. Palo Alto Networks advises administrators to consult the official security advisory for detailed upgrade guidance relevant to their specific installed release and maintenance branch.
For older maintenance lines within supported versions, additional fixes are also provided. For instance, PAN-OS 12.1 options include 12.1.4-h14 and 12.1.7-h12, while PAN-OS 11.2 options include 12.2.4-h2, 11.2.16-h2, 11.2.7-h24, 11.2.10-h18, and 11.2.13-h5. Hotfixes are also available for earlier maintenance releases of PAN-OS 11.1 and 10.2. Systems running unsupported versions of PAN-OS are strongly encouraged to migrate to a supported and patched release.
Currently, there are no known workarounds that can fully mitigate this vulnerability. Palo Alto Networks reiterates its long-standing recommendation to restrict management access to trusted internal IP addresses only. Exposing firewall or Panorama management interfaces to the internet or untrusted networks significantly increases the risk of exploitation. Implementing security best practices, such as restricting access via a dedicated jump box, can further reduce the attack surface, but these measures do not negate the need for applying the security updates.