{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-0330/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:palo_alto_networks:panorama:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-0330"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Panorama"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","cve-2026-0330","rce","panorama","palo-alto-networks"],"_cs_type":"advisory","_cs_vendors":["Palo Alto Networks"],"content_html":"\u003cp\u003ePalo Alto Networks has disclosed an authenticated remote code execution (RCE) vulnerability (CVE-2026-0330) affecting the Panorama management platform. The vulnerability allows an authenticated administrator with network access to the management interface to execute arbitrary code with root privileges. Palo Alto Networks reports that the issue is not currently being exploited in the wild and was discovered internally. Cloud NGFW and Prisma Access platforms are unaffected by this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an authenticated attacker root-level access to the Panorama appliance, potentially allowing full system compromise, data exfiltration, or configuration manipulation. The impact is highest when management interfaces are exposed to the public internet.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade affected Panorama appliances to the specified fixed versions listed in the vendor advisory (e.g., 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5, or 10.2.18-h14).\u003c/li\u003e\n\u003cli\u003eRestrict access to the Panorama management interface to trusted internal IP addresses or a dedicated management jump box.\u003c/li\u003e\n\u003cli\u003eEnable Threat ID 510045 and 510048 for customers with a Threat Prevention subscription; note that this requires SSL Decryption.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T21:53:31Z","date_published":"2026-11-11T21:53:31Z","id":"https://feed.craftedsignal.io/briefs/2026-11-panos-panorama-rce-cve-2026-0330/","summary":"An authenticated remote code execution vulnerability in Palo Alto Networks Panorama allows a high-privileged administrator to execute arbitrary code with root privileges.","title":"Palo Alto Networks Panorama: Authenticated Remote Code Execution (CVE-2026-0330)","url":"https://feed.craftedsignal.io/briefs/2026-11-panos-panorama-rce-cve-2026-0330/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-0330","version":"https://jsonfeed.org/version/1.1"}