Newshot 
Palo Alto Networks has disclosed a remote code execution (RCE) vulnerability in the PAN-OS operating system that runs on Panorama appliances, tracked as CVE-2026-0330. An authenticated administrator with network access can exploit the flaw to execute arbitrary code with root privileges.
On November 11, 2026, Palo Alto Networks released a security advisory urging users to install patches for affected Panorama deployments as soon as possible. Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls are not affected by this vulnerability.
Palo Alto Networks said it has not observed any malicious exploitation of the flaw to date, and that the vulnerability was discovered and reported by internal researcher Daniel Voce. The official advisory classifies the flaw as CWE-94, a code injection weakness.
Upon successful exploitation, an attacker can break out of the normal administrator privilege boundary and run code directly with root privileges without being constrained by regular administrative permissions. According to the published vulnerability assessment, exploitation requires a highly privileged account but no user interaction.
Affected Panorama appliances are vulnerable without any special configuration. However, exploitation requires both administrator authentication and network access. The vulnerability does not support unauthenticated exploitation, so arbitrary attackers on the internet cannot directly attack reachable systems.
Vulnerability rated medium severity, highest risk when management interface is exposed to the internet
Palo Alto Networks rates the vulnerability as medium severity, with a CVSS threat score of 6.1 and a base score of 8.6. The vendor lists patch remediation priority as medium, but warns that risk reaches the highest level if a device allows management access from external addresses.
The vulnerability is independent of the previously disclosed PAN-OS root-privilege code execution flaw CVE-2026-0322. CVE-2026-0322 has already seen exploitation in the wild, but those attacks are not evidence that attackers are exploiting this newly disclosed vulnerability.
Patches released for multiple PAN-OS versions, no effective workaround available
Fixes are now available for PAN-OS 12.2, 12.1, 11.2, 11.1, and 10.2 on the Panorama platform. The fixed versions on the latest maintenance line of each branch include 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5, and 10.2.18-h14. Administrators can follow the upgrade guidance in the advisory to complete the upgrade for the version they are running.
Fixes have also been released for earlier maintenance branches. Fixed versions on the PAN-OS 12.1 branch include 12.1.4-h14 and 12.1.7-h12; fixed versions on the PAN-OS 11.2 branch include 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, and 11.2.13-h5. Separate hotfixes are also available for older 11.1 and 10.2 maintenance releases.
Users on end-of-support versions need to upgrade to a release that is still within the maintenance window and has a published fix. There is no known workaround that addresses the root cause of the vulnerability, and Palo Alto Networks recommends restricting management access to trusted internal IP addresses.
Restricting management interface access is advised, but does not replace patching
Palo Alto Networks' management security guidelines explicitly warn against exposing the management interface of firewalls or Panorama to the internet or other untrusted networks.
Users can restrict management interface access to dedicated jump hosts to further reduce the attack surface. Multiple prior reports of security incidents caused by exposed PAN-OS management interfaces underscore the importance of this access boundary protection.
It is important to note that access restriction measures only reduce risk and cannot replace the remediation provided by security patches.
Palo Alto PAN-OS RCE Flaw Allows Attackers to Execute Arbitrary Code With Root Privileges