UpHeron
All vulnerabilities

Servers and applications

CVE-2026-0330

PAN-OS: Authenticated Remote Code Execution (RCE) in Panorama

Severity
Medium 6.1
Published
11 Nov 2026
Last changed
11 Nov 2026
Added to UpHeron
11 Nov 2026
Fixed in
10.2.18-h14, 11.1.16-h5, 11.2.16-h2, 12.1.10-h4, 12.2.4-h2
Weakness
Code injection (CWE-94)
Attack
Over the network · Needs an administrator account · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:M/U:Amber
Sources
CVE Program

Description

A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with network access to execute arbitrary code with root privileges.

The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.

From the CVE Program.

Affected software

SoftwareAffected versions
Palo Alto Networks PAN-OSServers and applications · cna:palo alto networks|pan-os
  • From 10.2.0 before 10.2.18-h14
  • From 11.1.0 before 11.1.16-h5
  • From 11.2.0 before 11.2.16-h2
  • From 12.1.0 before 12.1.10-h4
  • From 12.2.0 before 12.2.4-h2

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-0330