PAN-OS: Authenticated Admin Command Injection Vulnerability
Plan PatchCVSS 8.6CVE-2026-0320Oct 14, 2026
Palo Alto Networks
IT in OT - Palo Alto firewalls are commonly deployed at IT/OT network boundaries
Summary
A command injection vulnerability in PAN-OS, Prisma Access, and Panorama allows an authenticated administrator to bypass system restrictions and execute arbitrary commands as root. The vulnerability requires valid admin credentials and access to the management interface. It affects PA-Series firewalls, VM-Series firewalls, and Panorama. Cloud NGFW and Prisma Access cloud services are not affected.
What this means
What could happen
An authenticated admin with access to the management interface can execute arbitrary commands as root on the firewall, potentially disrupting network traffic filtering, exfiltrating configuration data, or altering security policies. This affects all PA-Series, VM-Series firewalls and Panorama.
Who's at risk
Operators of Palo Alto Networks PA-Series physical firewalls, VM-Series virtual firewalls, and Panorama centralized management systems should prioritize this issue. Cloud NGFW and Prisma Access cloud services are not affected by this specific vulnerability.
How it could be exploited
An attacker with valid administrator credentials and network access to the PAN-OS management interface (typically port 443) can inject shell commands through the admin interface that execute with root privileges, bypassing normal system restrictions.
Prerequisites
- Valid PAN-OS administrator credentials
- Network access to the management interface (typically HTTPS port 443)
- Access to PAN-OS management GUI or API
requires valid administrator credentialsrequires network access to management interfaceaffects critical security infrastructurecould lead to complete firewall compromise
Exploitability
Unlikely to be exploited — EPSS score 0.8%
Affected products (4)
4 with fix
ProductAffected VersionsFix Status
PAN-OSBelow 12.2.412.2.4+
Prisma AccessBelow 12.1.4-h1212.1.4-h12+
Prisma AccessBelow 12.1.7-h812.1.7-h8+
Prisma AccessBelow 12.1.10-h212.1.10-h2+
Remediation & Mitigation
0/6
Do now
0/2WORKAROUNDRestrict network access to the management interface to trusted internal IP addresses only via firewall rules or network segmentation
HARDENINGImplement multi-factor authentication for all administrator accounts accessing the management interface
Schedule — requires maintenance window
0/4Patching may require device reboot — plan for process interruption
PAN-OS
HOTFIXUpdate PAN-OS to version 12.2.4 or later
Prisma Access
HOTFIXUpdate Prisma Access to version 12.1.4-h12 or later (for 12.1.4.x branch)
HOTFIXUpdate Prisma Access to version 12.1.7-h8 or later (for 12.1.7.x branch)
HOTFIXUpdate Prisma Access to version 12.1.10-h2 or later (for 12.1.10.x branch)
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/dc9e9bac-10db-40a0-97de-9070c44418c4Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.