Palo Alto Networks has published security advisories disclosing three new vulnerabilities in its PAN-OS firewall software, with the most severe allowing authenticated administrators to execute arbitrary commands as root, effectively bypassing all system-level restrictions.
The most impactful of the three is CVE-2026-0273, a command injection flaw (CWE-78) rated CVSS 6.1 (Medium) under CVSS 4.0, though its base score reaches 8.6 without exploit maturity adjustments.
The vulnerability exists in PAN-OS® software and allows any authenticated administrator, via either the CLI or Web UI, to inject OS-level commands and execute them with root privileges, bypassing built-in system restrictions.
Critical Palo Alto PAN-OS Vulnerabilities
The flaw affects PA-Series and VM-Series firewalls as well as Panorama (both virtual and M-Series appliances) across PAN-OS versions 10.2, 11.1, 11.2, and 12.1.
Cloud NGFW and Prisma® Access are explicitly confirmed as unaffected. Published on June 10, 2026, and updated on June 11, the vulnerability was discovered externally, and Palo Alto Networks states that no malicious exploitation has been observed to date.
A closely related flaw, CVE-2026-0272, is a privilege-escalation vulnerability (CWE-862: Missing Authorization) rated at CVSS 6.0 (Medium).
It allows an authenticated administrator with CLI access to perform actions on the device with root-level privileges, a slightly narrower attack surface than CVE-2026-0273, since it requires only CLI access rather than Web UI exposure.
The vulnerability impacts the same hardware platforms and PAN-OS version branches (10.2 through 12.1) and similarly does not affect Cloud NGFW or Prisma Access.
The third vulnerability, CVE-2026-0269, is a memory corruption flaw (CWE-754) rated CVSS 4.6 (Medium) affecting tunnel traffic processing.
An authenticated user on an adjacent network can send a maliciously crafted packet to trigger an uncontrolled system reboot. Repeated exploitation forces the firewall into maintenance mode, causing sustained denial of service.
This CVE exclusively impacts firewalls configured with IPSec Tunnels or GlobalProtect Gateways and was notably discovered in production use, unlike the other two.
Affected & Patch Versions
| CVE | Affected PAN-OS Branches | Key Fixed Versions |
|---|---|---|
| CVE-2026-0273 | 10.2, 11.1, 11.2, 12.1 | 10.2.18-h7, 11.1.15, 11.2.12, 12.1.7 |
| CVE-2026-0272 | 10.2, 11.1, 11.2, 12.1 | 10.2.18-h5, 11.1.14, 11.2.11, 12.1.5 |
| CVE-2026-0269 | 10.2, 11.1, 11.2, 12.1 | 10.2.18, 11.1.12, 11.2.10, 12.1.5 |
Palo Alto Networks strongly recommends that organizations restrict access to the management interface to trusted internal IP addresses only, in line with its published best-practice deployment guidelines.
For CVE-2026-0273, customers with an active Threat Prevention subscription can block exploitation attempts by enabling Threat IDs 510028 and 510029, provided inbound management traffic is routed through a data-plane (DP) interface.
Organizations running any affected PAN-OS version on PA-Series or VM-Series hardware should treat these advisories with moderate urgency and prioritize patch deployment during their next maintenance window, as the risk escalates significantly when the management interface is exposed to the internet.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
