PAN-OS Command Injection Lets Admins Run Root Commands

Palo Alto Networks has disclosed a command injection vulnerability in PAN-OS software that allows authenticated administrators to execute arbitrary commands with root privileges. The issue, tracked as CVE-2026-0320, enables users to bypass system restrictions if they have access to the management interface. The vendor rates the severity as medium, noting that the risk is highest when the management interface is exposed to external IP addresses.

Root cause

The vulnerability stems from improper neutralization of special elements used in operating system commands, classified under CWE-78. According to the official advisory, this flaw allows an attacker with administrative credentials to inject commands that the system executes as the root user. No special configuration is required to be affected by this issue, meaning default deployments are vulnerable if the software version is within the affected range.

Attack path

Exploitation requires an attacker to first obtain valid administrative credentials for the PAN-OS management interface. Once authenticated, the user can trigger the command injection to run arbitrary shell commands. Palo Alto Networks states that the security risk is significantly minimized by restricting access to the management interface to only trusted internal IP addresses, as recommended in their best practice deployment guidelines.

Affected versions

This issue impacts PAN-OS software running on PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Cloud NGFW and Prisma Access are not affected. Affected versions include PAN-OS 12.1.4-h11 and earlier, 11.2.16 and earlier, 11.1.16-h3 and earlier, and 10.2.18-h12 and earlier. Specific minor version thresholds are detailed in the vendor advisory.

Mitigation

• Upgrade PAN-OS to version 12.1.4-h12, 11.2.16, 11.1.16-h3, or 10.2.18-h12 or later.
• Restrict access to the management interface to trusted internal IP addresses or a single jump box.
• Enable Threat IDs 510044 and 510049 in Applications and Threats content version 9159-10287 or later for limited coverage.
• Ensure SSL Decryption is enabled if relying on the Threat ID mitigation method.

Detection notes

Security teams should monitor management interface logs for unusual command execution patterns following administrative logins. Look for shell commands that do not correspond to standard configuration changes or maintenance tasks. Check for outbound connections from the firewall management plane to unknown external hosts, which could indicate command and control activity. Review authentication logs for logins from unexpected IP addresses or at unusual times. If anomalous behavior is detected, isolate the device from the management network immediately.

What to do and how to stay safe: Palo Alto Networks

• Verify your PAN-OS version against the affected list and apply updates once available.
• Audit firewall management access rules to ensure only trusted IPs can connect.
• Enable SSL decryption if using vendor-provided threat signatures for this vulnerability.
• Monitor admin session logs for unexpected command executions.

Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You

General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Are Cloud NGFW instances affected by CVE-2026-0320?

No, Cloud NGFW and Prisma Access are not affected by this vulnerability.

Has Palo Alto Networks observed any exploitation of this flaw?

The vendor states it is not aware of any malicious exploitation of this issue.

What is the CVSS score for this vulnerability?

The base CVSS score is 8.6, but it drops to 5.7 if access is restricted to local vectors.