{"id":"CVE-2026-0330","kind":"vulnerability","aliases":["CVE-2026-0330"],"related":[],"title":"PAN-OS on Panorama: authenticated admin can run code as root","description":"A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with network access to execute arbitrary code with root privileges.\n\n\n\nThe security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\n\n\nCloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.","summary":"A flaw in Palo Alto Networks PAN-OS on Panorama lets an authenticated administrator with network access run arbitrary code with root privileges. Restricting management interface access to trusted internal addresses significantly reduces the risk, according to the vendor.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","infrastructure","palo-alto-networks","pan-os","panorama"],"not_affected_if":["cloud-ngfw","management-interface-restricted","prisma-access","standalone-pan-os-firewall"],"how_to_check":"- Confirm whether the deployment runs Panorama with PAN-OS, as opposed to Cloud NGFW, Prisma Access or standalone PAN-OS firewalls, which the vendor says are not affected.\n- Check which addresses can reach the Panorama management interface; the sources do not give a version check command.","fix":null,"status":"open","published_at":"2026-11-11T20:17:03+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","triaged_at":"2026-11-11T20:30:17+00:00","updated_at":"2026-11-11T20:30:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T20:30:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"PAN-OS on Panorama: authenticated admin can run code as root","impact":"high","summary":"A flaw in Palo Alto Networks PAN-OS on Panorama lets an authenticated administrator with network access run arbitrary code with root privileges. Restricting management interface access to trusted internal addresses significantly reduces the risk, according to the vendor.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["panorama","pan-os","palo-alto-networks","firewall"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"root code execution on the Panorama management appliance","analyst_note":"Fixed versions and vendor advisory not in sources; check the Palo Alto Networks security advisory for CVE-2026-0330 for affected and fixed PAN-OS versions.","how_to_check":"- Confirm whether the deployment runs Panorama with PAN-OS, as opposed to Cloud NGFW, Prisma Access or standalone PAN-OS firewalls, which the vendor says are not affected.\n- Check which addresses can reach the Panorama management interface; the sources do not give a version check command.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["cloud-ngfw","prisma-access","standalone-pan-os-firewall","management-interface-restricted"],"who_is_affected":"Organizations running Palo Alto Networks Panorama with PAN-OS. The vendor states Cloud NGFW, Prisma Access and standalone PAN-OS firewalls are not affected. Exposure depends on who can reach the management interface and hold administrator credentials; the vendor says restricting management access to trusted internal addresses significantly minimizes the risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000795,"input_tokens":4690,"output_tokens":653,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-0330':15A,18A '-2026':14A,17A '/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431':132C 'access':46B,56B,91C,111C,136C 'accord':65B,122C 'address':60B,121C 'admin':7A 'administr':43B,88C 'affect':145C 'alto':23B,33B,77C 'arbitrari':48B,94C 'authent':6A,42B,87C 'best':126C 'cloud':133C 'code':10A,49B,71C,95C 'cve':13A,16A 'deploy':128C 'enabl':85C 'execut':72C,93C 'firewal':19B,142C 'flaw':30B 'guidelin':129C 'infrastructur':20B 'interfac':55B,115C 'intern':59B,119C 'ip':120C 'issu':105C 'let':40B 'live.paloaltonetworks.com':131C 'live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431':130C 'manag':54B,114C 'minim':108C 'network':24B,34B,45B,78C,90C 'ngfw':134C 'os':3A,27B,37B,81C,141C 'palo':22B,32B,76C 'palo-alto-network':21B 'pan':2A,26B,36B,80C,140C 'pan-o':1A,25B,35B,79C,139C 'panorama':5A,28B,39B,84C 'pose':102C 'practic':127C 'prisma':135C 'privileg':52B,98C 'rce':73C 'recommend':125C 'reduc':62B 'remot':70C 'restrict':53B,110C 'risk':64B,101C 'root':12A,51B,97C 'run':9A,47B 'secur':100C 'signific':61B,107C 'softwar':82C 'standalon':138C 'trust':58B,118C 'vendor':68B 'vulner':74C,148C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Palo Alto Networks Panorama with PAN-OS. The vendor states Cloud NGFW, Prisma Access and standalone PAN-OS firewalls are not affected. Exposure depends on who can reach the management interface and hold administrator credentials; the vendor says restricting management access to trusted internal addresses significantly minimizes the risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["firewall","infrastructure","medium","paloaltonetworks","panorama","panos"],"campaign_type":null,"search_a":"'-0330':15A,18A '-2026':14A,17A 'admin':7A 'authent':6A 'code':10A 'cve':13A,16A 'os':3A 'pan':2A 'pan-o':1A 'panorama':5A 'root':12A 'run':9A","search_b":"'access':46B,56B 'accord':65B 'address':60B 'administr':43B 'alto':23B,33B 'arbitrari':48B 'authent':42B 'code':49B 'firewal':19B 'flaw':30B 'infrastructur':20B 'interfac':55B 'intern':59B 'let':40B 'manag':54B 'network':24B,34B,45B 'os':27B,37B 'palo':22B,32B 'palo-alto-network':21B 'pan':26B,36B 'pan-o':25B,35B 'panorama':28B,39B 'privileg':52B 'reduc':62B 'restrict':53B 'risk':64B 'root':51B 'run':47B 'signific':61B 'trust':58B 'vendor':68B","search_c":"'/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431':132C 'access':91C,111C,136C 'accord':122C 'address':121C 'administr':88C 'affect':145C 'alto':77C 'arbitrari':94C 'authent':87C 'best':126C 'cloud':133C 'code':71C,95C 'deploy':128C 'enabl':85C 'execut':72C,93C 'firewal':142C 'guidelin':129C 'interfac':115C 'intern':119C 'ip':120C 'issu':105C 'live.paloaltonetworks.com':131C 'live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431':130C 'manag':114C 'minim':108C 'network':78C,90C 'ngfw':134C 'os':81C,141C 'palo':76C 'pan':80C,140C 'pan-o':79C,139C 'panorama':84C 'pose':102C 'practic':127C 'prisma':135C 'privileg':98C 'rce':73C 'recommend':125C 'remot':70C 'restrict':110C 'risk':101C 'root':97C 'secur':100C 'signific':107C 'softwar':82C 'standalon':138C 'trust':118C 'vulner':74C,148C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T20:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:Amber","cvss_by":"psirt@paloaltonetworks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-0330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0330","severity":null,"published_at":"2026-11-11T20:17:03+00:00","modified_at":"2026-11-11T20:17:03+00:00","first_seen_at":"2026-11-11T20:28:52+00:00","fetched_at":"2026-11-11T20:28:52+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}