PAN-OS Admins Can Now Patch Root Command Execution Flaw CVE-2026-0320
Admins can now patch a medium-severity flaw allowing root command execution on PAN-OS devices. Updates are available for most versions, with a fix ETA for others.
Key points
- CVE-2026-0320 allows authenticated admins to run arbitrary root commands on PAN-OS.
- Fixes are available for 12.x, 11.1.x, and 10.2.x series; 11.2.x updates arrive October 15.
- Cloud NGFW and Prisma Access are unaffected; Panorama and PA/VM-Series are vulnerable.
Palo Alto Networks has released patches for CVE-2026-0320, a medium-severity command injection vulnerability in PAN-OS software. The flaw enables an authenticated administrator to bypass system restrictions and execute arbitrary commands with root privileges. According to the vendor’s advisory, the issue affects PA-Series and VM-Series firewalls as well as Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access products are not affected by this vulnerability.
How it unfolded
- Palo Alto Networks PSIRT published an advisory for CVE-2026-0320, classifying it as a medium-severity issue with moderate urgency.
- The vendor confirmed that no special configuration is required for a system to be affected by this command injection flaw.
- Patches were immediately released for 12.1.x, 11.1.x, and 10.2.x version lines, while 11.2.x fixes are scheduled for October 15.
Who is affected
Organizations running PAN-OS on PA-Series hardware, VM-Series virtual firewalls, or Panorama management appliances are exposed to this risk. The vulnerability exists in versions prior to 12.1.4-h12, 11.1.4-h37, and 10.2.7-h38, among others. Users on the 11.2.x branch remain vulnerable until the October 15 update window. The CVSS base score is 8.6, reflecting high impact on confidentiality, integrity, and availability, though the attack requires high-privilege access.
Our take on the response
The vendor’s assessment notes that the risk is significantly minimized if access to the management interface is restricted to trusted internal IP addresses. Palo Alto Networks states it is not aware of any malicious exploitation of this issue. Customers with Threat Prevention subscriptions can enable Threat IDs 510044 and 510049 for limited coverage, provided SSL Decryption is enabled. The recommended remediation remains upgrading to the patched software versions as soon as possible.
Who needs to act first
Teams should prioritize updating firewalls and Panorama instances that have management interfaces accessible from untrusted networks. Before deploying the patch, verify compatibility with existing configurations and back up the current state. Test the update in a non-production environment to ensure stability. If immediate patching is not feasible, restrict management access to a single jump box with strict IP allow-lists to reduce the attack surface while waiting for the fix.
What to do and how to stay safe: Palo Alto Networks
- Inventory all PAN-OS devices to identify those running vulnerable versions listed in the advisory.
- Apply the available patches for 12.1.x, 11.1.x, and 10.2.x series immediately to close the vulnerability.
- Schedule the 11.2.x updates for the October 15 release date and test them before production rollout.
- Restrict management interface access to trusted internal IPs or a dedicated jump box to mitigate risk.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is CVE-2026-0320 being exploited in the wild?
No, Palo Alto Networks states it is not aware of any malicious exploitation of this issue.
Which Palo Alto products are not affected by this vulnerability?
Cloud NGFW and Prisma Access are not affected by this vulnerability.
When will the fix for PAN-OS 11.2.x be available?
The fix for the 11.2.x series is expected to be available on October 15.
