PAN-OS
CVE-2026-0320: Authenticated Admin Command Injection Vulnerability
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Cloud NGFW | Not affected |
| PAN-OS 12.2 | 12.2.4 or later |
| PAN-OS 12.1 | 12.1.4-h12, 12.1.7-h8, 12.1.10-h2 or later |
| PAN-OS 11.2 | 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16 or later |
| PAN-OS 11.1 | 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3 or later |
| PAN-OS 10.2 | 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12 or later |
| Prisma Access | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
In short
An authenticated administrator with access to the PAN-OS management interface can exploit a command injection flaw to bypass system restrictions. This allows the attacker to execute arbitrary commands with root privileges on the firewall or Panorama appliance. The vulnerability requires network access to the management interface and valid administrative credentials, but no further user interaction is needed.
Written by a language model from the vendor's description. Versions, fixes and exploitation status on this page come straight from the vendor and CISA.
The vendor's description
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface.
The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431).
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Am I affected?
No special configuration is required to be affected by this issue.
Workarounds
No known workarounds exist for this issue.
Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510044 and 510049 (from Applications and Threats content version 9159-10287 and later). Please note that this Threat ID requires SSL Decryption.
Exploitation
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 19 Oct 2026.