Palo Alto Networks Addresses Medium-Severity Command Injection in PAN-OS

Palo Alto Networks has released security updates for CVE-2026-0320, a medium-severity command injection vulnerability in its PAN-OS software. The flaw enables an authenticated administrator with access to the management interface to bypass system restrictions and execute arbitrary commands as a root user. This issue affects PA-Series and VM-Series firewalls as well as Panorama virtual and M-Series appliances.

The vendor rates the severity as medium with a CVSS-BT score of 6.1 and a CVSS-B score of 8.6. According to the official advisory, the risk is significantly minimized by restricting access to the management interface to trusted internal IP addresses. Palo Alto Networks stated that it is not aware of any malicious exploitation of this issue in the wild. The company recommends remediation as soon as possible.

Context and Background

This vulnerability stems from improper neutralization of special elements used in an OS command, classified under CWE-78. An attacker must first obtain administrative credentials to exploit the flaw through the PAN-OS management interface. The advisory notes that no special configuration is required for a device to be affected by this issue. The risk is highest when organizations allow access to the management interface from external IP addresses on the internet.

This release follows recent security updates from the vendor, including patches for CVE-2026-0322, a high-severity authenticated remote code execution flaw in the PAN-OS management interface. That earlier vulnerability also allowed attackers to execute code as root. This pattern highlights the ongoing importance of securing administrative interfaces on network security appliances.

Who Is Affected

Cloud NGFW and Prisma Access services are not affected by this vulnerability. The flaw impacts specific versions of PAN-OS software running on physical and virtual firewalls. Affected versions include PAN-OS 11.2 prior to 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, and 11.2.16. Updates for these branches are expected to be available by October 15.

PAN-OS 11.1 versions prior to 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, and 11.1.16-h3 are also vulnerable. Similarly, PAN-OS 10.2 versions before 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, and 10.2.18-h12 require updates. Customers with a Threat Prevention subscription can enable Threat IDs 510044 and 510049 for limited coverage, provided SSL Decryption is enabled.

What should you do?

Administrators should verify their current PAN-OS version against the affected lists provided in the advisory. Upgrading to the recommended patched versions is the primary remediation step. For PAN-OS 12.1, users should upgrade to 12.1.4-h12 or 12.1.10-h2 or later. For older branches, specific hotfix versions are listed in the vendor's documentation.

Organizations should also review their network architecture to ensure the management interface is not accessible from the public internet. Restricting access to a jump box or specific internal IP addresses reduces the attack surface. This mitigation ensures that an attacker must first compromise a trusted system to reach the management interface.

What to do and how to stay safe: Palo Alto Networks

• Verify if your firewall is running an affected version of PAN-OS by checking the release notes.
• Schedule an upgrade to the latest patched version available for your specific PAN-OS branch.
• Restrict access to the management interface to trusted internal IP addresses or a dedicated jump box.
• Enable Threat IDs 510044 and 510049 if you have a Threat Prevention subscription and SSL Decryption.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is CVE-2026-0320 being exploited in the wild?

No, Palo Alto Networks stated it is not aware of any malicious exploitation of this vulnerability.

Which devices are affected by CVE-2026-0320?

The vulnerability affects PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances.

Are Cloud NGFW and Prisma Access affected?

No, Cloud NGFW and Prisma Access services are not affected by this command injection vulnerability.