Palo Alto PAN-OS Flaws Enable Root Command Execution, Privilege Escalation, and DoS

Palo Alto Networks disclosed and patched multiple vulnerabilities in PAN-OS affecting PA-Series, VM-Series, and Panorama, including CVE-2026-0273, an authenticated administrator command injection flaw in the CLI and web management interface that can allow arbitrary commands to run as root. The vendor also fixed CVE-2026-0272, an authenticated CLI privilege escalation issue, and CVE-2026-0266, a stored XSS vulnerability in the web interface. A separate issue, CVE-2026-0269, can trigger a denial of service through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode.

Affected versions span supported PAN-OS 12.1, 11.2, 11.1, and 10.2 release trains, while Cloud NGFW and Prisma Access were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for CVE-2026-0273, organizations with Threat Prevention can also enable dedicated Threat IDs to help block exploit attempts when management traffic is inspectable and decrypted.