Cpe:2.3:a:palo_alto_networks:panorama:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3apalo_alto_networkspanorama/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 21:53:31 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPalo Alto Networks Panorama: Authenticated Remote Code Execution (CVE-2026-0330)https://feed.craftedsignal.io/briefs/2026-11-panos-panorama-rce-cve-2026-0330/Wed, 11 Nov 2026 21:53:31 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-panos-panorama-rce-cve-2026-0330/An authenticated remote code execution vulnerability in Palo Alto Networks Panorama allows a high-privileged administrator to execute arbitrary code with root privileges.Palo Alto Networks has disclosed an authenticated remote code execution (RCE) vulnerability (CVE-2026-0330) affecting the Panorama management platform. The vulnerability allows an authenticated administrator with network access to the management interface to execute arbitrary code with root privileges. Palo Alto Networks reports that the issue is not currently being exploited in the wild and was discovered internally. Cloud NGFW and Prisma Access platforms are unaffected by this vulnerability.

Impact

Successful exploitation grants an authenticated attacker root-level access to the Panorama appliance, potentially allowing full system compromise, data exfiltration, or configuration manipulation. The impact is highest when management interfaces are exposed to the public internet.

Recommendation

  • Upgrade affected Panorama appliances to the specified fixed versions listed in the vendor advisory (e.g., 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5, or 10.2.18-h14).
  • Restrict access to the Panorama management interface to trusted internal IP addresses or a dedicated management jump box.
  • Enable Threat ID 510045 and 510048 for customers with a Threat Prevention subscription; note that this requires SSL Decryption.
]]>mediumadvisoryvulnerabilitycve-2026-0330rcepanoramapalo-alto-networks