Palo Alto PAN-OS CVE-2026-0330: Panorama Root RCE Fix

Palo Alto Networks published an advisory on 11 November 2026 for a PAN-OS flaw that lets an attacker run arbitrary code as root. The headline is alarming, and parts of it are justified: root on a security appliance is about as bad as it gets. But the details matter more than the headline. This one is CVE-2026-0330, it affects Panorama, it needs an authenticated administrator, and Palo Alto says it is not aware of any exploitation.

A different PAN-OS flaw, CVE-2026-0322, was exploited in October and is easy to confuse with this one. Both are covered below so you can tell them apart.

The short version

• What: CVE-2026-0330, a code injection flaw (CWE-94) that lets an authenticated administrator with network access run arbitrary code with root privileges.
• Where: Panorama running PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2. Cloud NGFW, Prisma Access and standalone PAN-OS firewalls are not affected.
• Severity: Medium, urgency "moderate" in the advisory, though the base score is high (see below).
• Exploited: Palo Alto says it is not aware of malicious exploitation. Exploit maturity is listed as unreported.
• Fix: upgrade Panorama to a fixed release. No workaround is known.

What the advisory says

Why 6.1 and 8.6 at the same time?

One news write-up called those two numbers inconsistent. They aren't. The first, CVSS-BT, is the base score adjusted by threat information: here, exploit maturity "unreported" pulls it down. The second, CVSS-B, is the base score alone, which is high because a successful attack has high impact on confidentiality, integrity and availability. The advisory shows both, and its urgency rating follows the lower, threat-adjusted score. That reading comes from the vector in the advisory (it includes the exploit maturity field), not from an explanation Palo Alto gives, so treat it as my interpretation.

Is "attackers can execute code as root" accurate?

Yes, with a condition that the headline drops: the attacker must already be an authenticated administrator who can reach Panorama over the network. This is not an unauthenticated attack from the internet. Its practical meaning is privilege escalation: a user who can log in as an administrator, a stolen admin credential, or a compromised admin session can turn that access into full control of the underlying operating system, below the level the product normally exposes.

That matters because Panorama manages other firewalls. Root on a management server can mean visibility into, or influence over, the configuration of every device it manages. I'm describing the general role of Panorama here, not a confirmed attack path for this CVE, and the advisory doesn't discuss one.

Affected and fixed versions

The advisory lists fixed releases per branch. Find your Panorama's branch, then check you are at or above the fixed hotfix for it:

Unsupported older versions have no fix; the advisory says to upgrade to a supported fixed release. Read the way hotfix versions work: 11.2.7-h24 fixes the 11.2.7 line, and it does not mean 11.2.7-h10 is fixed. The "or later" applies within a line, so match your maintenance release first. Where it's ambiguous, trust the advisory page over any table, including this one.

On the Panorama CLI, the installed version can be read with:

show system info | match sw-version

That is the standard PAN-OS way to display the software version, but I didn't run it against a device. The web interface shows the same value on the dashboard.

Reduce exposure while you schedule the upgrade

The advisory states that restricting management access to trusted internal IP addresses significantly reduces the risk, and gives a lower score when access goes through a jump box. In practice:

• Never expose Panorama's management interface to the internet or to general user networks.
• Allow management only from a small set of internal addresses or a dedicated jump host. In the PAN-OS web interface this is the management interface's permitted IP addresses setting. Check Palo Alto's documentation for the exact location in your version, as I haven't verified the menu path.
• Reduce the number of administrator accounts, remove stale ones and require MFA where you can. The flaw needs an administrator, so every admin account is part of the attack surface.
• Palo Alto notes that customers with a Threat Prevention subscription get limited coverage from Threat IDs 510045 and 510048, and that this requires SSL decryption. It is partial coverage, not a substitute for patching.

The advisory says access restriction reduces risk but doesn't replace the update.

Don't mix it up with CVE-2026-0322

The same weeks brought a second, better-known PAN-OS flaw:

The 0322 details come from The Hacker News coverage, not the vendor page, which I couldn't open. If you patched for 0322 in October, you may still need the new Panorama release for 0330. The fixed hotfix numbers differ.

The Hacker News also lists three IP addresses that Palo Alto assessed as linked to the 0322 activity: 66.42.72.14, 208.83.239.114 and 149.248.47.234. If you keep management-interface access logs, a quick look is cheap:

grep -E -w '66\.42\.72\.14|208\.83\.239\.114|149\.248\.47\.234' /path/to/your/access.log

No hits don't mean you are clean (attackers change addresses), and these are not indicators for CVE-2026-0330. The -w flag makes 66.42.72.14 not match 66.42.72.145. I tested the command against a sample log.

A sensible order of operations

1. Inventory every Panorama (physical and virtual) and its PAN-OS version.
2. Check that none are reachable from untrusted networks, and fix that first. It takes minutes.
3. Schedule upgrades to the fixed release for each branch, starting with the most exposed.
4. Review administrator accounts, API keys and recent admin logins.
5. After the upgrade, confirm the new version and that managed devices still check in.

Common mistakes

• Assuming "medium" means "can wait" on a device with root-level impact. A moderate score reflects the admin requirement and no known exploitation, not harmlessness.
• Confusing the two CVEs, and patching only one.
• Checking firewalls but forgetting Panorama.
• Applying the wrong hotfix for your maintenance line.
• Treating a management interface behind a VPN as safe without limiting who can log in.

Frequently asked questions

Does CVE-2026-0330 affect my PA-Series firewall?

According to the advisory, standalone PAN-OS firewalls, Cloud NGFW and Prisma Access are not affected by this CVE. CVE-2026-0322 is the one that covers firewalls.

Is it exploited in the wild?

Palo Alto says it is not aware of any malicious exploitation of CVE-2026-0330. That can change, so check the advisory page.

Can an unauthenticated attacker use it?

The advisory requires an authenticated administrator with network access.

Is there a workaround?

None known. Restricting management access lowers risk but does not fix the flaw.

Related Dev Talk articles

• Chrome Zero-Day CVE-2026-125350: What It Is, Who Is Affected and How to Update
• Malicious Claude Code Extension in the Cursor Marketplace: What Happened and How to Check Your Machine

Sources

• Palo Alto Networks: CVE-2026-0330 advisory
• Cyber Security News: Palo Alto Networks PAN-OS RCE Vulnerability
• The Hacker News: Palo Alto Networks patches PAN-OS authenticated RCE flaw (CVE-2026-0322)

Originally published on DEV Talk.