Palo Alto Networks has disclosed a high-severity buffer overflow vulnerability in PAN-OS that could allow unauthenticated, network-based attackers to execute arbitrary code with root privileges on PA-Series hardware firewalls.
Tracked as CVE-2026-0310, the flaw affects XML processing functionality in PAN-OS and was published on September 9, 2026.
The vulnerability is classified as CWE-787, an out-of-bounds write issue caused by a buffer overflow during XML processing. An unauthenticated attacker with network access to either a firewall’s management web interface or dataplane interface could trigger the flaw.
Palo Alto PAN-OS Flaw
On PA-Series firewalls, successful exploitation could enable arbitrary code execution with root privileges.
Root-level execution on a perimeter firewall presents a substantial enterprise risk, potentially allowing an intruder to alter security policies, intercept or manipulate traffic, establish persistence, steal credentials, or move laterally into protected environments.
The same issue has a different impact on VM-Series firewalls. Palo Alto Networks said exploitation against virtual firewalls is limited to causing a denial-of-service condition, not code execution.
No special configuration is required for a device to be vulnerable. However, exposure depends heavily on whether an attacker can reach the management or dataplane interfaces.
Palo Alto Networks said the risk can be reduced by restricting management access to trusted internal IP addresses and using a dedicated jump box as the only system permitted to access the interface.
Affected Products and Versions
CVE-2026-0310 impacts PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 releases, as well as Panorama deployments. Cloud NGFW for AWS and Azure is also listed as affected.
Palo Alto Networks categorized the issue as highest urgency, emphasizing that PA-Series appliances face the most severe outcome because exploitation can result in root-level code execution.
The vendor rated the vulnerability as medium severity for VM-Series products because the consequence is restricted to service disruption.
Prisma Access and Cloud NGFW instances are also affected, but the vendor assessed their practical risk as lower. Exploitation in those environments requires an authenticated user and is constrained by restricted external network access.
Palo Alto Networks said it is not aware of malicious exploitation of CVE-2026-0310 in the wild. The company’s security research teams discovered the issue internally, and exploit maturity is currently listed as unreported.
Organizations should upgrade vulnerable PAN-OS installations to a fixed release as soon as operationally possible. PAN-OS 12.2 users should update to version 12.2.3 or later, while PAN-OS 12.1 users should move to 12.1.10, 12.1.7-h5, or 12.1.4-h10 depending on their maintenance branch.
For PAN-OS 11.2, fixed releases include 11.2.4-h21, 11.2.7-h20, 11.2.10-h14, and 11.2.13-h2. PAN-OS 11.1 users should deploy the corresponding fixed hotfix release, while PAN-OS 10.2 deployments should update to 10.2.7-h37, 10.2.10-h40, 10.2.13-h24, 10.2.16-h10, or 10.2.18-h10.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
