PAN-OS (Panorama): Authenticated remote code execution

Summary

A remote code execution vulnerability in PAN-OS on Panorama, the central management appliance for Palo Alto firewalls, allows an authenticated administrator with network access to run arbitrary code with root privileges. Exploitation requires valid administrator credentials, and the vendor states that restricting management interface access to trusted internal IP addresses significantly reduces the risk. Cloud NGFW, Prisma Access and standalone PAN-OS firewalls are not affected.

Affected

• Panorama running PAN-OS 12.2.0 to below 12.2.4-h2
• Panorama running PAN-OS 12.1.0 to below 12.1.10-h4 (per branch, see vendor table)
• Panorama running PAN-OS 11.2.0 to below 11.2.16-h2 (per branch, see vendor table)
• Panorama running PAN-OS 11.1.0 to below 11.1.16-h5 (per branch, see vendor table)
• Panorama running PAN-OS 10.2.0 to below 10.2.18-h14 (per branch, see vendor table)
• Older unsupported PAN-OS releases
• Not affected: Cloud NGFW, Prisma Access, standalone PAN-OS firewalls

Fixed in

• 12.2: 12.2.4-h2 or later
• 12.1: 12.1.4-h14, 12.1.7-h12 or 12.1.10-h4 or later (per branch)
• 11.2: 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5 or 11.2.16-h2 or later (per branch)
• 11.1: 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17 or 11.1.16-h5 or later (per branch)
• 10.2: 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13 or 10.2.18-h14 or later (per branch)
• Older unsupported releases: upgrade to a supported fixed version
• Note: third-party trackers list only one fixed build per release train; use the vendor table.

Workaround

No known workarounds exist for this issue.

• Restricting management interface access to trusted internal IP addresses or a jump box reduces exposure but is not a fix.
• Customers with a Threat Prevention subscription get limited coverage by enabling Threat IDs 510045 and 510048 (requires SSL Decryption).

Exploitation

• Palo Alto Networks is not aware of any malicious exploitation of this issue.
• At the time of research, no public exploit or proof of concept was reported (VulDB, OffSeq).
• Not listed in CISA KEV according to a third-party index.

Our recommendation

• Check whether Panorama is used in your environment and identify its PAN-OS build.
• Upgrade Panorama to the fixed build for your release train, as listed in the vendor table.
• Restrict Panorama's management interface to trusted internal IP addresses or a jump box, and enforce strong administrator authentication and MFA where supported. This is a mitigation, not a fix.
• Monitor the vendor advisory and CISA KEV for changes, as the information is recent.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Palo Alto Networks Security Advisory CVE-2026-0330 security.paloaltonetworks.com
• CVE Record CVE-2026-0330 www.cve.org
• VulDB entry 435972 vuldb.com
• OffSeq threat radar CVE-2026-0330 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:23.