Palo Alto Networks PAN-OS Vulnerability Could Allow Root-Level Code Execution

Palo Alto Networks has disclosed a high-severity vulnerability affecting multiple versions of PAN-OS. The flaw could allow an unauthenticated attacker to execute arbitrary code. Affected PA-Series hardware firewalls could be compromised with root privileges.

Tracked as CVE-2026-0310, the vulnerability was disclosed on September 9, 2026. It affects XML processing within PAN-OS. Palo Alto Networks assigned the issue its highest remediation urgency. Organizations using affected firewall appliances should address the vulnerability promptly.

Security Alert: Organizations operating affected Palo Alto Networks PA-Series firewalls should review their PAN-OS versions. Administrators should also review management interface exposure. Appropriate security updates should be prioritized.

What Is CVE-2026-0310?

CVE-2026-0310 is a buffer overflow vulnerability. It is classified as CWE-787: Out-of-Bounds Write.

An attacker needs network access to a vulnerable PAN-OS interface. This could include a management web interface or dataplane interface. Specially crafted XML data could then trigger the vulnerability.

The potential impact depends on the Palo Alto Networks firewall platform.

On PA-Series hardware firewalls, successful exploitation could allow arbitrary code execution with root privileges.

On VM-Series virtual firewalls, exploitation is limited to a denial-of-service condition. Remote code execution is not listed as the primary impact.

PAN-OS Panorama deployments, Prisma Access, and Cloud NGFW environments may also be affected. Conditions and potential impacts vary between platforms.

Why This Vulnerability Matters

Firewalls sit at one of the most sensitive points within an organization’s infrastructure. They inspect network traffic and enforce security policies. They also establish VPN connections and separate internal systems from untrusted networks.

Root-level access to a perimeter firewall could potentially allow an attacker to:

• Modify or disable firewall security policies
• Inspect or manipulate network traffic
• Access sensitive firewall configuration information
• Establish persistence on the appliance
• Disrupt network connectivity or security inspection
• Use the firewall as a foothold for further attacks

For PA-Series hardware, CVE-2026-0310 presents a significant security concern. Its potential impact goes beyond a traditional denial-of-service vulnerability.

Which PAN-OS Versions Are Affected?

Affected releases include versions of:

• PAN-OS 12.2
• PAN-OS 12.1
• PAN-OS 11.2
• PAN-OS 11.1
• PAN-OS 10.2

Palo Alto Networks has released patched versions across affected maintenance branches.

Organizations running unsupported PAN-OS versions should migrate to a supported release. The selected release should contain the applicable security fix.

Is CVE-2026-0310 Being Exploited?

As of Palo Alto Networks’ September 9 disclosure, malicious exploitation was not known. The company reported no known exploitation in the wild.

Organizations should not wait for active exploitation before taking action.

Internet-facing infrastructure often receives increased attention following public vulnerability disclosures. This vulnerability could provide root-level access to PA-Series firewalls. Organizations should therefore treat patching as a priority.

What Should Organizations Do?

Organizations should first identify their current PAN-OS versions. Administrators should determine whether those versions fall within an affected release.

Affected systems should be upgraded to the appropriate fixed PAN-OS version. Normal testing and change-management procedures should still be followed.

Administrators should also review how firewall management interfaces are exposed.

Palo Alto Networks recommends restricting management access to trusted internal IP addresses. Organizations should use dedicated administrative systems where possible. A jump system can also restrict access to firewall management interfaces.

Management interfaces should not be directly exposed to untrusted networks. Any exception should have a documented operational requirement.

Security teams should also review logs for suspicious administrative activity. Unexplained configuration changes should receive additional review. Unexpected firewall restarts may also warrant investigation.

Reducing Your Firewall Attack Surface

CVE-2026-0310 also demonstrates why patching should not be an organization’s only defense.

Critical network infrastructure should use multiple layers of security.

Administrative interfaces should have tightly restricted access. Management traffic should be separated from normal user traffic where possible. Organizations should also periodically review firewall rules.

These reviews can identify unnecessary administrative exposure introduced over time.

Limiting access does not eliminate the need for patching. However, it can significantly reduce exposure to vulnerable services.

Next Phase Tech Partners Can Help

Keeping critical infrastructure secure requires planning, testing, and ongoing visibility. Organizations must also balance security improvements with business availability.

Next Phase Tech Partners helps organizations evaluate infrastructure risks. We also manage systems and security technologies. Our cybersecurity strategies are designed to support business operations.

If your organization uses Palo Alto Networks firewalls, review your environment now. Check PAN-OS versions, management interface exposure, and firewall security practices.

Don’t wait for a vulnerability to become an active incident before addressing it.

Contact Next Phase Tech Partners to discuss your infrastructure and cybersecurity needs. We can also help with vulnerability management and security planning.

Reference

Palo Alto Networks Security Advisory:

CVE-2026-0310 – PAN-OS Buffer Overflow Vulnerability via XML Processing