Palo Alto PAN-OS Vulnerability Allows Root-Level Code Execution
A critical buffer overflow vulnerability in Palo Alto Networks' PAN-OS, CVE-2026-0310, enables unauthenticated attackers to achieve root-level code execution on PA-Series firewalls.
Palo Alto Networks has disclosed a critical vulnerability, CVE-2026-0310, within its PAN-OS network operating system that could allow unauthenticated remote attackers to execute arbitrary code with root privileges on affected PA-Series hardware firewalls. The flaw, identified as a buffer overflow and classified under CWE-787 (out-of-bounds write), resides within the system's XML processing capabilities.
An attacker with network access to a vulnerable management or dataplane interface could exploit this vulnerability by sending specially crafted XML data. Successful exploitation on PA-Series appliances grants an attacker complete control over the firewall's operating environment, enabling them to alter security policies, inspect or redirect network traffic, establish persistence mechanisms, steal sensitive configuration data, or leverage the compromised device as a pivot point for further attacks against internal networks.
While the vulnerability does not require authentication or user interaction, Palo Alto Networks has rated its exploitation complexity as high. The vendor assigned CVE-2026-0310 a CVSS-BT score of 7.2 and a base CVSS-B score of 9.2 for affected PA-Series firewalls, highlighting the severe potential impact on perimeter security devices.
The impact of the vulnerability varies across Palo Alto Networks' product line. On VM-Series firewalls, exploitation is limited to causing a denial-of-service condition rather than code execution. For Prisma Access and Cloud NGFW environments, the risk is considered lower due to the requirement for authenticated access and more restricted external network connectivity.
Several PAN-OS versions are affected, including releases prior to 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10, along with numerous maintenance builds across the 10.2, 11.1, 11.2, and 12.1 branches. Palo Alto Networks strongly recommends immediate upgrades to the appropriate fixed release, such as PAN-OS 12.2.3 or later for the 12.2 branch.
No workaround is currently available for CVE-2026-0310. However, organizations can mitigate exposure by ensuring that firewall management interfaces are not accessible from untrusted networks. Palo Alto Networks advises restricting management access to trusted internal IP addresses and, where feasible, conducting administration solely through a dedicated jump box.
Palo Alto Networks stated that it discovered the vulnerability internally and, as of September 9, 2026, has no knowledge of it being exploited maliciously in the wild. The disclosure underscores the ongoing threat posed by vulnerabilities in critical network infrastructure components.