---
id: "CVE-2026-0330"
page: "https://infrastack.ai/live/CVE-2026-0330"
kind: "vulnerability"
aliases: ["CVE-2026-0330"]
title: "PAN-OS on Panorama: authenticated admin can run code as root"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["firewall", "infrastructure", "palo-alto-networks", "pan-os", "panorama"]
not_affected_if: ["cloud-ngfw", "management-interface-restricted", "prisma-access", "standalone-pan-os-firewall"]
published_at: "2026-11-11T20:17:03+00:00"
first_seen_at: "2026-11-11T20:28:52+00:00"
updated_at: "2026-11-11T20:30:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0330", "first_seen_at": "2026-11-11T20:28:52+00:00"}]
exploit_sources: []
---

# PAN-OS on Panorama: authenticated admin can run code as root

Link for people: https://infrastack.ai/live/CVE-2026-0330 (this .md is for agents)

A flaw in Palo Alto Networks PAN-OS on Panorama lets an authenticated administrator with network access run arbitrary code with root privileges. Restricting management interface access to trusted internal addresses significantly reduces the risk, according to the vendor.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the deployment runs Panorama with PAN-OS, as opposed to Cloud NGFW, Prisma Access or standalone PAN-OS firewalls, which the vendor says are not affected.
- Check which addresses can reach the Panorama management interface; the sources do not give a version check command.

## Timeline

- 2026-11-11T20:28:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-0330

## From the sources

A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with network access to execute arbitrary code with root privileges.



The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .



Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_