Palo Alto PAN-OS Flaw Enables Unauthenticated Root Code Execution
Attack Surface Exposure · 9 sources · Updated 1mo ago · First seen Sep 10, 2026
Palo Alto Networks disclosed CVE-2026-0310, a high-severity XML-processing buffer overflow in PAN-OS that can allow an unauthenticated remote attacker to execute arbitrary code as root on affected PA-Series hardware firewalls. The flaw, scored 9.2 CVSS-B, is reachable through vulnerable management-web or dataplane interfaces using specially crafted XML; exploitation is considered high complexity. On VM-Series appliances, the impact is limited to denial of service, while Prisma Access and Cloud NGFW deployments face more restricted exposure because exploitation requires authentication and their external interfaces are less accessible.
Palo Alto Networks released fixed PAN-OS versions and states that no workaround is available; administrators should immediately apply the vendor updates and restrict management access to trusted networks. Canadian and Italian government advisories also identify affected PAN-OS, Prisma Access, and Cloud NGFW on AWS and Azure products, and flag PAN-SA-2026-0012 for Chromium vulnerabilities affecting Prisma Browser versions before 151.26.5.170. Palo Alto reported no known exploitation of CVE-2026-0310 in the wild as of September 9, 2026.
