Palo Alto Networks has identified a significant remote code execution vulnerability within its PAN-OS software, specifically affecting Panorama systems. This security flaw, cataloged as CVE-2026-0330, enables authenticated administrators with network access to execute arbitrary code with root privileges, posing a critical risk.
Patch Urgency and Affected Systems
Issued on November 11, 2026, the advisory highlights the necessity for users to promptly update Panorama deployments to mitigate risks. Notably, other products such as Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls remain unaffected.
Although Palo Alto Networks has not identified any active exploitation of this vulnerability, it credits internal researcher Daniel Voce for its discovery. The flaw is identified as CWE-94, a known code injection weakness.
Exploitation Details and Requirements
The vulnerability allows administrators to bypass typical restrictions by executing code with root privileges, a scenario that requires both authentication and network access. This is a controlled threat, as it demands administrative credentials and cannot be executed by an unauthenticated user remotely.
No special configurations are necessary for a vulnerable Panorama installation. However, the exploitation risk increases significantly if management access is exposed to external internet addresses. Palo Alto Networks assigns this vulnerability a medium severity rating, with a CVSS score of 6.1 and a base score of 8.6.
Mitigation Steps and Security Recommendations
Administrators are advised to apply the recommended patches for PAN-OS versions 12.2, 12.1, 11.2, 11.1, and 10.2. Specific patched releases include 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5, and 10.2.18-h14, among others. It is crucial to follow the upgrade guidance provided in the official advisory.
For older maintenance lines, appropriate updates are available, but unsupported versions should transition to a supported, patched release. While no workaround resolves the vulnerability, reducing management access to trusted internal IP addresses is recommended.
Palo Alto Networks emphasizes the importance of adhering to management security guidelines, advising against exposing management interfaces to untrusted networks. Implementing access via a dedicated jump box can further mitigate exposure.
In conclusion, while applying patches is imperative, restricting access forms an essential layer of defense. Organizations must remain vigilant and proactive in updating their security protocols to safeguard against potential threats.
