CVE-2026-0331: PAN-OS: Sensitive Information Disclosure Vulnerability
CVE-2026-0331
Summary
A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with network access to execute arbitrary code with root privileges.
The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.
Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.
Products covered
Cloud NGFW
PAN-OS
Prisma Access
PAN-OS 12.2
PAN-OS 12.1
PAN-OS 11.2
PAN-OS 11.1
PAN-OS 10.2
Remediation
Version | Minor Version | Suggested Solution |
|---|---|---|
Cloud NGFW | No action needed. | |
PAN-OS 12.2 | 12.2.0 through 12.2.4-h* | Upgrade to 12.2.4-h2 or later. |
PAN-OS 12.1 | 12.1.8 through 12.1.10-h* | Upgrade to 12.1.10-h4 or later. |
12.1.5 through 12.1.7-h* | Upgrade to 12.1.7-h12 or later. | |
12.1.2 through 12.1.4-h* | Upgrade to 12.1.4-h14 or later. | |
PAN-OS 11.2 | 11.2.15 through 11.2.16-h* | Upgrade to 11.2.16-h2 or later. |
11.2.11 through 11.2.13-h* | Upgrade to 11.2.13-h5 or 11.2.16-h2 or later. | |
11.2.8 through 11.2.10-h* | Upgrade to 11.2.10-h18 or 11.2.16-h2 or later. | |
11.2.5 through 11.2.7-h* | Upgrade to 11.2.7-h24 or 11.2.16-h2 or later. | |
11.2.0 through 11.2.4-h* | Upgrade to 11.2.4-h24 or 11.2.16-h2 or later. | |
PAN-OS 11.1 | 11.1.14 through 11.1.16-h* | Upgrade to 11.1.16-h5 or later. |
11.1.11 through 11.1.13-h* | Upgrade to 11.1.13-h17 or 11.1.16-h5 or later. | |
11.1.8 through 11.1.10-h* | Upgrade to 11.1.10-h37 or 11.1.16-h5 or later. | |
11.1.7 through 11.1.7-h* | Upgrade to 11.1.7-h13 or 11.1.16-h5 or later. | |
11.1.5 through 11.1.6-h* | Upgrade to 11.1.6-h41 or 11.1.16-h5 or later. | |
11.1.0 through 11.1.4-h* | Upgrade to 11.1.4-h39 or 11.1.16-h5 or later. | |
PAN-OS 10.2 | 10.2.17 through 10.2.18-h* | Upgrade to 10.2.18-h14 or later. |
10.2.14 through 10.2.16-h* | Upgrade to 10.2.16-h13 or 10.2.18-h14 or later. | |
10.2.11 through 10.2.13-h* | Upgrade to 10.2.13-h28 or 10.2.18-h14 or later. | |
10.2.8 through 10.2.10-h* | Upgrade to 10.2.10-h43 or 10.2.18-h14 or later. | |
10.2.0 through 10.2.7-h* | Upgrade to 10.2.7-h40 or 10.2.18-h14 or later. | |
All older unsupported PAN-OS versions | Upgrade to a supported fixed version. | |
Prisma Access | No action needed. |
Vendor-listed fixes
Cloud NGFW All
PAN-OS 12.2 >= 12.2.4-h2 on Panorama
PAN-OS 12.1 >= 12.1.4-h14 on Panorama, >= 12.1.7-h12 on Panorama, >= 12.1.10-h4 on Panorama
PAN-OS 11.2 >= 11.2.4-h24 on Panorama, >= 11.2.7-h24 on Panorama, >= 11.2.10-h18 on Panorama, >= 11.2.13-h5 on Panorama, >= 11.2.16-h2 on Panorama
PAN-OS 11.1 >= 11.1.4-h39 on Panorama, >= 11.1.6-h41 on Panorama, >= 11.1.7-h13 on Panorama, >= 11.1.10-h37 on Panorama, >= 11.1.13-h17 on Panorama, >= 11.1.16-h5 on Panora
PAN-OS 10.2 >= 10.2.7-h40 on Panorama, >= 10.2.10-h43 on Panorama, >= 10.2.13-h28 on Panorama, >= 10.2.16-h13 on Panorama, >= 10.2.18-h14 on Panorama
Prisma Access All
CVEs in this advisory 1
Updates
- Published by Palo Alto Networks
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.