Palo Alto Networks discloses CVE-2026-0330 Panorama PAN-OS RCE flaw

What happened

According to the Palo Alto Networks security advisory (PSIRT), published 2026-11-11, PAN-OS software on Panorama contains a remote code execution flaw tracked as CVE-2026-0330. The vendor says it lets an authenticated administrator with network access execute arbitrary code with root privileges. Palo Alto Networks PSIRT

The vendor says the issue was discovered internally and credits Daniel Voce, an internal reporter. It classifies the weakness as CWE-94 (code injection). It rates severity as MEDIUM with suggested urgency MODERATE, giving CVSS-BT 6.1 and CVSS-B 8.6. If access is limited to a single jump box, it gives CVSS-BT 5.7 and CVSS-B 8.4. Palo Alto Networks PSIRT

Palo Alto Networks says it is not aware of any malicious exploitation. This is the only source for this story. No independent verification or third-party reporting is available, and any detail beyond the vendor advisory is not confirmed. Palo Alto Networks PSIRT

Am I affected?

According to the vendor, only PAN-OS running on Panorama is affected. Cloud NGFW, Prisma Access and standalone PAN-OS firewalls are listed as not affected. No special configuration is required to be exposed. Palo Alto Networks PSIRT

The affected trains named in the advisory are PAN-OS 12.2, 12.1, 11.2, 11.1 and 10.2 on Panorama, below the fixed builds listed in the advisory. Older unsupported PAN-OS versions are also covered, and the vendor says to upgrade those to a supported fixed version. The vendor says the risk is highest when the management interface is open to external IP addresses on the internet, and that restricting it to trusted internal IP addresses significantly reduces the risk. Palo Alto Networks PSIRT

What to do now

1. Identify any Panorama systems and their PAN-OS versions.
2. Upgrade to the fixed build for your train as listed in the vendor advisory. Examples from the advisory: 12.2.4-h2 or later for 12.2, 12.1.10-h4 or later for the 12.1.8 through 12.1.10 range, 11.2.16-h2 or later for 11.2.15 and 11.2.16, 11.1.16-h5 or later for 11.1.14 through 11.1.16, and 10.2.18-h14 or later for 10.2.17 and 10.2.18. Earlier minor releases have their own fixed builds in the advisory table. Palo Alto Networks PSIRT
3. Restrict management interface access to trusted internal IP addresses, ideally a single jump box, as the vendor recommends. Palo Alto Networks PSIRT
4. The vendor says no known workarounds exist. Customers with a Threat Prevention subscription get limited coverage by enabling Threat ID 510045 and 510048 (Applications and Threats content version 9171-10349 and later), which requires SSL Decryption. This is not a substitute for upgrading. Palo Alto Networks PSIRT

Sources

• Palo Alto Networks PSIRT: CVE-2026-0330 PAN-OS: Authenticated Remote Code Execution (RCE) in Panorama