Palo Alto fixes root code execution in Panorama, CVE-2026-0330

Palo Alto fixes root code execution in Panorama, CVE-2026-0330

11 November 2026: Palo Alto Networks has fixed CVE-2026-0330, a flaw in PAN-OS on Panorama that lets an authenticated administrator with network access run arbitrary code with root privileges. It rates the issue 6.1, medium, with no exploitation reported, and says Cloud NGFW, Prisma Access and standalone PAN-OS firewalls are not affected.

Not yet independently verified. Severity, scores and the list of other advisories are taken from Palo Alto Networks' own advisory pages; we opened the CVE-2026-0330 page in full but only the index for the other seven, and found no independent report. We will update this when it can be confirmed, and remove this note.

Why a medium score still matters

The score is low because the attacker must already be a Panorama administrator. The impact is not: Panorama manages policy for every firewall attached to it, so root on Panorama is a path from one stolen admin account to the whole estate. Palo Alto says the risk is "significantly minimized" by restricting the management interface to trusted internal IP addresses, its standing advice. The flaw was discovered internally. The advisory's own scoring describes the attack as network-based, low in complexity and needing no user interaction, but not automatable and requiring high privileges, which is why it lands at medium despite full confidentiality, integrity and availability impact on the product.

Fixed versions

The fix ships as hotfixes on each maintained branch. Panorama on these releases or later is unaffected:

• PAN-OS 12.2: 12.2.4-h2
• PAN-OS 12.1: 12.1.4-h14, 12.1.7-h12, 12.1.10-h4
• PAN-OS 11.2: 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2
• PAN-OS 11.1: 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5
• PAN-OS 10.2: 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14

Pick the hotfix on the maintenance release you already run; moving to a different maintenance line is not required.

The rest of the November release

Seven more advisories were published the same day, all rated lower by Palo Alto's own scores: CVE-2026-0329, a PAN-OS buffer overflow (4.6); CVE-2026-0324 in the GlobalProtect app on Windows through the OPSWAT MetaDefender SDK (5.9); CVE-2026-0328, user impersonation through the GlobalProtect portal (2.7); CVE-2026-0327, a GlobalProtect privilege escalation (2.3); CVE-2026-0326, a buffer overflow in protocol and service processing (1.7); CVE-2026-0325, a GlobalProtect authorisation bypass (1.3); and CVE-2026-0323, a server-side request forgery in Checkov (1.1). A separate bulletin, PAN-SA-2026-0014, covers this month's Chromium fixes in Palo Alto products.

Teams that patch GlobalProtect clients on a different cycle from Panorama should read CVE-2026-0324 first, the highest score in the group after Panorama's.

Our catalogue lists Palo Alto Networks among its cybersecurity companies.

Sources

• Palo Alto Networks: CVE-2026-0330 PAN-OS: Authenticated Remote Code Execution (RCE) in Panorama, 11 November 2026
• Palo Alto Networks security advisories index, 11 November 2026