Palo Alto PAN-OS Buffer Overflow Lets Attackers Execute Arbitrary Code as Root

Palo Alto Networks has announced a high-severity buffer overflow vulnerability in PAN-OS that may allow unauthenticated, network-based attackers to execute arbitrary code with root privileges on affected PA-Series hardware firewalls.

This vulnerability is tracked as CVE-2026-0310 and stems from PAN-OS XML processing. It impacts both the firewall management web interfaces and the dataplane interfaces.

The advisory, published on September 9, 2026, assigns a CVSS v4.0 base score of 9.2 and a CVSS-BT score of 7.2. Palo Alto Networks has classified its recommended remediation urgency as “highest.”

Palo Alto PAN-OS Buffer Overflow

CVE-2026-0310 is categorized as CWE-787, which refers to an out-of-bounds write vulnerability. The issue arises from unsafe XML handling, leading to a buffer overflow that a remote attacker could trigger without authentication, special privileges, user interaction, or specific configurations.

If exploited on PA-Series appliances, the vulnerability could allow arbitrary code execution with root privileges. Gaining root access to a perimeter firewall poses a significant risk, as an intruder could alter security policies, disable protections, intercept or manipulate network traffic, establish persistence, or use the device as an internal pivot point.

The vulnerability affects Palo Alto Networks products in different ways:

Product type	Potential impact	Severity
PA-Series firewalls	Arbitrary code execution as root	High
VM-Series firewalls	Denial-of-service condition	Medium
Prisma Access and Cloud NGFW	Reduced exposure; authenticated access required	Medium

Palo Alto Networks indicates the risk is highest for PA-Series hardware firewalls because of potential code execution. In contrast, VM-Series firewalls’ impact is limited to denial of service, which, while less severe, can still disrupt critical business connectivity and inspection functions.

Affected PAN-OS Releases

The vulnerability affects PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2 before specific fixed maintenance releases. Users of PAN-OS 12.2 should upgrade to version 12.2.3 or later.

Organizations on PAN-OS 12.1 should upgrade to either 12.1.4-h10, 12.1.7-h5, or 12.1.10, depending on their supported maintenance train. Fixed versions are also available for PAN-OS branches 11.2, 11.1, and 10.2, specifically 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10.

Unsupported PAN-OS releases remain vulnerable, and users are encouraged to migrate to a supported fixed version. Palo Alto Networks has stated that no special configuration is necessary for a device to be vulnerable.

No workaround is currently available, so software updates are the primary remediation. Administrators should prioritize patching internet-exposed PA-Series firewalls and ensure that management interfaces are not accessible from untrusted networks.

Palo Alto Networks recommends limiting management access to trusted internal IP addresses. Ideally, a dedicated jump box should be the only system allowed to access the management interface, reducing the reachable attack surface before completing the upgrade.

Security teams are advised to review administrative access rules, the exposure of HTTPS and management services, recent configuration changes, unexpected firewall restarts, and anomalous XML-related requests.

While Palo Alto Networks is not aware of any malicious exploitation at this time, the combination of unauthenticated access and potential root-level code execution underscores the necessity for rapid patching.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.