CVE-2026-0330

PAN-OS: Authenticated Remote Code Execution (RCE) in Panorama

publishedCWE-94

A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with network access to execute arbitrary code with root privileges. The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.

Technical severity6.1 mediumCVSS 4.0 · CNA: palo_alto

Published2026-11-11Source updated 2026-11-11

Collected2026-11-111 attributed source

Fixes and workarounds

Fix

VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h2 or later. PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h4 or later. 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h12 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h14 or later. PAN-OS 11.2 11.2.15 through 11.2.16-h* Upgrade to 11.2.16-h2 or later. 11.2.11 through 11.2.13-h* Upgrade to 11.2.13-h5 or 11.2.16-h2 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h18 or 11.2.16-h2 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h24 or 11.2.16-h2 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h24 or 11.2.16-h2 or later. PAN-OS 11.1 11.1.14 through 11.1.16-h* Upgrade to 11.1.16-h5 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h17 or 11.1.16-h5 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h37 or 11.1.16-h5 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h13 or 11.1.16-h5 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h41 or 11.1.16-h5 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h39 or 11.1.16-h5 or later. PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18-h14 or later. 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h13 or 10.2.18-h14 or later. 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h28 or 10.2.18-h14 or later. 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h43 or 10.2.18-h14 or later. 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h40 or 10.2.18-h14 or later. All older Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access No action needed.

Source: CNA: palo_alto

Workaround

No known workarounds exist for this issue. Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510045 and 510048 (from Applications and Threats content version 9171-10349 and later). Please note that this Threat ID requires SSL Decryption.

Source: CNA: palo_alto

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
Cloud NGFW Palo Alto Networks	All (unaffected, custom) Other versions: unaffected	CNA: palo_alto
PAN-OS Palo Alto Networks Platforms: Panorama	≥ 12.2.0; < 12.2.4-h2 (affected, custom); unaffected at 12.2.4-h2 ≥ 12.1.0; < 12.1.10-h4 (affected, custom); unaffected at 12.1.10-h4; unaffected at 12.1.7-h12; unaffected at 12.1.4-h14 ≥ 11.2.0; < 11.2.16-h2 (affected, custom); unaffected at 11.2.16-h2; unaffected at 11.2.13-h5; unaffected at 11.2.10-h18; unaffected at 11.2.7-h24; unaffected at 11.2.4-h24 ≥ 11.1.0; < 11.1.16-h5 (affected, custom); unaffected at 11.1.16-h5; unaffected at 11.1.13-h17; unaffected at 11.1.10-h37; unaffected at 11.1.7-h13; unaffected at 11.1.6-h41; unaffected at 11.1.4-h39 ≥ 10.2.0; < 10.2.18-h14 (affected, custom); unaffected at 10.2.18-h14; unaffected at 10.2.16-h13; unaffected at 10.2.13-h28; unaffected at 10.2.10-h43; unaffected at 10.2.7-h40 Other versions: unaffected	CNA: palo_alto
Prisma Access Palo Alto Networks	All (unaffected, custom) Other versions: unaffected	CNA: palo_alto

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
4.0 / 6.1 medium	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:M/U:Amber`	CNA: palo_alto
4.0 / 5.7 medium	`CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber`	CNA: palo_alto

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References

https://security.paloaltonetworks.com/CVE-2026-0330CNA: palo_alto · vendor-advisory

For agents and automation

Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.

Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.

Get an API key Use x402 Connect an agent

Endpoints and access details

https://api.y2.dev/api/v2/cyber/cves
https://api.y2.dev/api/v2/cyber/cves/{cveId}

A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.

For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.

Agent access JSON · OpenAPI · CVE API guide