Palo Alto Networks Panorama: Authenticated Remote Code Execution (CVE-2026-0330)
An authenticated remote code execution vulnerability in Palo Alto Networks Panorama allows a high-privileged administrator to execute arbitrary code with root privileges.
CVE search metadata
CVE search record: CVE-2026-0330. KEV: no. Product: Panorama. Brief: Palo Alto Networks Panorama: Authenticated Remote Code Execution (CVE-2026-0330). Brief link: https://feed.craftedsignal.io/briefs/2026-11-panos-panorama-rce-cve-2026-0330/
Triage facts
Revision 1- Applicability
- Panorama
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 21:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Unlikely
Palo Alto Networks has disclosed an authenticated remote code execution (RCE) vulnerability (CVE-2026-0330) affecting the Panorama management platform. The vulnerability allows an authenticated administrator with network access to the management interface to execute arbitrary code with root privileges. Palo Alto Networks reports that the issue is not currently being exploited in the wild and was discovered internally. Cloud NGFW and Prisma Access platforms are unaffected by this vulnerability.
Impact
Successful exploitation grants an authenticated attacker root-level access to the Panorama appliance, potentially allowing full system compromise, data exfiltration, or configuration manipulation. The impact is highest when management interfaces are exposed to the public internet.
Recommendation
- Upgrade affected Panorama appliances to the specified fixed versions listed in the vendor advisory (e.g., 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5, or 10.2.18-h14).
- Restrict access to the Panorama management interface to trusted internal IP addresses or a dedicated management jump box.
- Enable Threat ID 510045 and 510048 for customers with a Threat Prevention subscription; note that this requires SSL Decryption.
Immediate actions
Inventory all Panorama instances and verify current PAN-OS versions against the vulnerability matrix.
Restrict management interface access to a secure, limited-access jump box.
Threat Hunt
Audit administrative activity logs on Panorama for anomalous configuration changes or system commands executed by high-privileged accounts.
Data: Panorama administrative audit logs, SSH/management interface session logs
Mitigations
Upgrade to a fixed version as specified in the Palo Alto Networks CVE-2026-0330 advisory.
CVE-2026-0330