top of page

PAN-OS Buffer Overflow Allows Root Code Execution (CVE-2026-0310)

September 23rd, 2026

High

Our Cyber Threat Intelligence Unit has identified CVE-2026-0310, a high-severity buffer overflow in the XML processing of Palo Alto Networks PAN-OS software. The vulnerability was identified internally by the vendor and disclosed on September 9, 2026, with fixed builds released for all affected supported branches on the same date. An unauthenticated attacker with network access to either the management web interface or the dataplane interface can trigger the vulnerability to cause a denial-of-service condition on VM-Series firewalls or execute arbitrary code with root privileges on PA-Series hardware firewalls. Panorama is also impacted. Prisma Access and Cloud NGFW are affected at a lower severity, as exploitation in those environments requires an authenticated user and external network access is restricted. No special configuration is required for a system to be exposed. No user interaction or privileges are required in the PA-Series and VM-Series scenarios. The vendor assigns Severity HIGH with a Suggested Urgency of HIGHEST, reflecting the prospect of full root-level compromise of a perimeter security control. Palo Alto Networks states it is not aware of any malicious exploitation. CVE-2026-0310 is not listed in CISA's Known Exploited Vulnerabilities catalog as of September 20, 2026, and no public exploit code has been reported. Palo Alto Networks published additional PAN-OS advisories in the same release, including CVE-2026-0308 and CVE-2026-0309, which carry different prerequisites and should be assessed separately. Organizations should note that no vendor-supported workaround exists. Restricting management interface access reduces exposure on the management path only and does not address the dataplane interface. Upgrading to a fixed release is the sole complete remediation.

Technical Details

  • CVE ID: CVE-2026-0310.

  • Vulnerability Type: Buffer overflow leading to remote code execution or denial of service.

  • Severity: High.

    • CVSS (PA-Series): CVSS-B 9.2 / CVSS-BT 7.2,

    • CVSS (VM-Series): CVSS-B 8.7 / CVSS-BT 6.6, MEDIUM.

      • Impact limited to denial of service.

    • CVSS (Prisma Access, Cloud NGFW): CVSS-B 7.5 / CVSS-BT 4.8, MEDIUM.

      • Requires an authenticated user and restricted external access.

  • Affected Products: PAN-OS on PA-Series and VM-Series firewalls, Panorama, Prisma Access, Cloud NGFW (all AWS and Azure deployments).

  • Affected Versions:

    • PAN-OS 12.2: prior to 12.2.3

    • PAN-OS 12.1: prior to 12.1.4-h10, 12.1.7-h5, 12.1.10

    • PAN-OS 11.2: prior to 11.2.4-h21, 11.2.7-h20, 11.2.10-h14, 11.2.13-h2

    • PAN-OS 11.1: prior to 11.1.4-h36, 11.1.6-h38, 11.1.7-h10, 11.1.10-h33, 11.1.13-h12, 11.1.16-h2

    • PAN-OS 10.2: prior to 10.2.7-h37, 10.2.10-h40, 10.2.13-h24, 10.2.16-h10, 10.2.18-h10

    • Prisma Access: 12.1 prior to 12.1.7-h5, 11.2 prior to 11.2.7-h20, 10.2 prior to 10.2.10-h40

    • All older unsupported PAN-OS versions.


Attack Chain/Method:

  • Initial access:Attacker reaches the management web interface or the dataplane interface over the network. No credentials, privileges, or user interaction are required.

  • Exploitation: A crafted XML document is submitted to the vulnerable parsing routine, causing a write beyond the intended memory boundary.

  • Impact divergence: On PA-Series hardware, memory corruption is leveraged to execute arbitrary code as root. On VM-Series, the observed outcome is a denial-of-service condition.

  • Post-exploitation:Root execution on a PA-Series device yields full control of the firewall, including policy manipulation, traffic inspection, credential and configuration access, and use of the device as a pivot into adjacent network segments.

Image by ThisisEngineering

Impact

  • Remote code execution with root privileges on PA-Series hardware firewalls, without authentication, granting complete control of the device.

  • Security control subversion: An attacker with root access can alter or disable security policies, NAT rules, and logging, allowing subsequent activity to proceed uninspected and unlogged.

  • Credential and configuration exposure: Firewall configuration stores administrative credentials, certificates, VPN pre-shared keys, and authentication server integration details, all accessible following root compromise.

  • Lateral movement and pivoting: A compromised perimeter firewall provides a trusted network position spanning multiple segments, including management networks.

  • Denial of service on VM-Series firewalls, producing loss of connectivity and inspection for all traffic traversing the affected instance.

  • Centralized management compromise: Panorama is impacted, and compromise at that tier places configuration control of every managed firewall at risk.

  • Detection and forensic degradation: Root-level access allows log tampering on the device itself, complicating incident reconstruction.

Detection Method

  • Exposure and Access:

    • Alert on connections to firewall management web interfaces originating from any source outside the approved administrative address ranges.

  • Exploitation Attempt Indicators:

    • Monitor for XML payloads of anomalous size or structure submitted to management web interface endpoints and to dataplane-facing services.

    • Alert on unexpected dataplane process restarts, management plane restarts, or unscheduled device reboots, which may indicate failed exploitation attempts against the memory corruption condition.

    • Monitor system logs for crash dumps, core files, and segmentation-fault entries generated by XML parsing processes.

  • Post-Compromise Indicators:

    • Alert on configuration change events, administrator account creation, and modifications to logging or log-forwarding profiles that do not correlate with an approved change record.

    • Monitor for outbound connections initiated from firewall management interfaces to external destinations, which are not expected under normal operation and would indicate post-exploitation command and control.

    • Alert on gaps or abrupt terminations in log forwarding from a firewall to the SIEM, consistent with log suppression following device compromise.

  • Investigation and Prioritization:

    • Correlate any of the above against the device's PAN-OS version to prioritize investigation on unpatched hosts.

    • Retain and review management plane authentication logs for the period preceding patch application, as exploitation prior to remediation would not be resolved by the upgrade.

Indicators of Compromise

There are no Indicators of Compromises Observed.

mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

  • Upgrade to a fixed release immediately. This is the only complete remediation.

    • Target versions by branch: PAN-OS 12.2.3 or later; 12.1.10, 12.1.7-h5, or 12.1.4-h10 as applicable to the running branch; 11.2.13-h2, 11.2.10-h14, 11.2.7-h20, or 11.2.4-h21; 11.1.16-h2, 11.1.13-h12, 11.1.10-h33, 11.1.7-h10, 11.1.6-h38, or 11.1.4-h36; 10.2.18-h10, 10.2.16-h10, 10.2.13-h24, 10.2.10-h40, or 10.2.7-h37.

  • Prioritize PA-Series hardware firewalls first, as these carry the root code execution outcome rather than denial of service.

  • Migrate devices on unsupported PAN-OS branches to a supported fixed version. These require release-path planning beyond a hotfix and should be identified at the start of the response, not the end.

  • Prisma Access and Cloud NGFW tenants will be upgraded by the vendor during the next scheduled maintenance cycle. Organizations requiring earlier remediation should request an on-demand upgrade window through vendor support.

  • Inventory Panorama deployments and include them in the remediation scope. Compromise at the management tier has consequences across every managed device.

  • Restrict management interface access to a dedicated jump host or a narrow set of trusted internal addresses as an interim exposure-reduction measure. This is not a workaround and does not remove risk on the dataplane path.

  • Remove firewall management interfaces from internet exposure. Validate externally facing attack surface independently rather than relying on documented configuration.

  • Segment management networks from general user and server VLANs, and require administrative access to traverse a controlled access path.

  • Confirm log forwarding to the SIEM is active and intact for all firewall and Panorama devices, so that tampering on a compromised device is detectable centrally.

  • Review device logs covering the period prior to patch deployment for the detection signals in Section 4.0. Patching does not evict an attacker who gained access beforehand.

  • Track the related PAN-OS advisories released on September 9, 2026, including CVE-2026-0308 and CVE-2026-0309, and assess them within the same maintenance cycle.

Conclusion

CVE-2026-0310 introduces a pre-authentication memory corruption in a perimeter security control, with the most severe outcome being arbitrary code execution as root on PA-Series hardware firewalls. High attack complexity and the absence of reported exploitation or public exploit code moderate near-term likelihood, but they do not reduce the consequence of compromise. The vendor's urgency rating reflects that balance. No workaround exists. Defensive priority is straightforward: upgrade every affected PAN-OS, Panorama, and Prisma Access instance to a named fixed release, starting with internet-reachable PA-Series hardware; remove management interfaces from untrusted network exposure; and review pre-patch telemetry for evidence of access obtained before remediation.

bottom of page