Loading vulnerability…
Authenticated CLI Privilege Escalation in Palo Alto Networks PAN-OS
CVE-2026-0272 is a privilege escalation vulnerability in the Palo Alto Networks PAN-OS command-line interface that allows an authenticated administrator with CLI access to perform actions with root privileges. It affects vulnerable releases in the PAN-OS 12.1, 11.2, 11.1, and 10.2 release trains on PA-Series and VM-Series firewalls and Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access are not affected. The specific vulnerable function and underlying implementation flaw are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated administrator to exceed their intended administrative privileges and perform root-level actions on the affected firewall or Panorama appliance, compromising the device's privilege boundary.
If you can’t patch tonight, do this now.
Limit CLI access to a small group of trusted administrators and restrict management-interface access to trusted internal IP addresses. Use a hardened jump host for management access. These controls reduce exposure but do not correct the underlying vulnerability.
Patch, then assume compromise.
Upgrade to an applicable vendor-fixed PAN-OS release. Fixes include 12.1.4-h7 and 12.1.5; 11.2.4-h18, 11.2.7-h16, 11.2.10-h9, and 11.2.11; 11.1.4-h34, 11.1.6-h33, 11.1.7-h7, 11.1.10-h27, 11.1.13-h7, and 11.1.14; and 10.2.7-h35, 10.2.10-h37, 10.2.13-h22, 10.2.16-h8, and 10.2.18-h5. Select the appropriate fixed release for the installed maintenance branch. Migrate unsupported branches to a supported fixed release. For RUGGEDCOM APE1808 deployments with Palo Alto Networks Virtual NGFW, contact Siemens support for applicable patch and update guidance.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.