CVE-2026-0320: PAN-OS: Authenticated Admin Command Injection Vulnerability (Severity: MEDIUM)
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface.
The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431).
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.2.4Fixed in 12.1.10-h2Fixed in 12.1.7-h8Fixed in 12.1.4-h12Fixed in 11.2.16Fixed in 11.2.13-h3Fixed in 11.2.10-h15Fixed in 11.2.7-h21Fixed in 11.2.4-h22Fixed in 11.1.16-h3Fixed in 11.1.13-h15Fixed in 11.1.10-h35Fixed in 11.1.7-h11Fixed in 11.1.6-h39Fixed in 11.1.4-h37Fixed in 10.2.18-h12Fixed in 10.2.16-h11Fixed in 10.2.13-h26Fixed in 10.2.10-h41Fixed in 10.2.7-h38 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.7-h38 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.10-h41 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.13-h26 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.16-h11 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 10.2.18-h12 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.4-h37 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.6-h39 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.7-h11 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.10-h35 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.13-h15 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.16-h3 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.4-h22 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.7-h21 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.10-h15 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.13-h3 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.16 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.1.4-h12 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.1.7-h8 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.1.10-h2 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.2.4 - Configuration
Enable Threat IDs 510044 and 510049 using Applications and Threats content version 9159-10287 or later; this coverage requires SSL Decryption.
PAN-OS Threat Prevention Threat IDs 510044 and 510049 = enabled - Compensating control
Restrict access to the PAN-OS management interface to trusted internal IP addresses.
Event History
Frequently Asked Questions
Which deployments are affected, and which are not?
The issue applies to PAN-OS on PA-Series and VM-Series firewalls and to Panorama, including virtual and M-Series Panorama. Cloud NGFW and Prisma Access are not affected.
What level of access does an attacker need?
An attacker must already be an authenticated administrator and must be able to access the PAN-OS management interface. No user interaction is required once those conditions are met.
What can a successful attacker do?
A successful attacker can bypass system restrictions and execute arbitrary commands as the root user.
What mitigation is available if patching cannot be performed immediately?
Restrict access to the management interface to trusted internal IP addresses in accordance with the recommended deployment guidance. This significantly minimizes the security risk by limiting who can reach the interface.