CVE-2026-0320

Awaiting Analysis Awaiting Analysis - Queue

Command Injection in Palo Alto PAN-OS

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: Palo Alto Networks, Inc.

Description

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface. The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-0320

EUVD

EUVD-2026-101631

Affected Vendors & Products

Vendor	Product	Version / Range
Palo	Alto	Networks PAN-OS 12.2.0
Palo	Alto	Networks PAN-OS 12.1.0
Palo	Alto	Networks PAN-OS 11.2.0
Palo	Alto	Networks PAN-OS 11.1.0
Palo	Alto	Networks PAN-OS 10.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a command injection vulnerability in Palo Alto Networks PAN-OS software. An authenticated administrator can bypass system restrictions and execute arbitrary commands with root privileges through the management interface.

Detection Guidance

This vulnerability requires authenticated access to the PAN-OS management interface. Detection should focus on monitoring for unauthorized command execution attempts or unusual administrative activity. Check logs for suspicious commands in the management interface logs and review firewall configurations for unauthorized changes.

Impact Analysis

An attacker with access to the management interface could take full control of the affected device, install malware, exfiltrate data, or disrupt network operations. The impact is limited to systems where the management interface is exposed to untrusted networks.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized root-level command execution if an authenticated administrator with access to the management interface is compromised. Unauthorized access or control of network devices may violate data protection and security requirements under these regulations.

Mitigation Strategies

Restrict access to the PAN-OS management interface to only trusted internal IP addresses as per best practice deployment guidelines.

Hi! I’m here to help you understand CVE-2026-0320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70