Palo Alto Networks has patched a serious flaw in PAN-OS allowing unauthenticated actors to gain root‐level control over some firewalls. The issue, tracked as CVE-2026-0310, stems from a buffer overflow in XML processing, which Palo Alto classifies as CWE-787. The affected systems include PA-Series hardware firewalls. Exploitation could allow sending malicious XML to the management web or dataplane interface to run arbitrary code as root. This poses high risk to devices responsible for core enterprise firewall duties and perimeter security.
Details of the Vulnerability
The flaw requires no authentication or user interaction. Attackers merely need network access to targeted interfaces to trigger the vulnerability. Though Palo Alto notes high complexity for successful exploitation, the consequences are severe: full control over the firewall. Attackers might alter policy settings, inspect or reroute network traffic, maintain persistence, or harvest configuration data.
Impact varies by product. Physical PA-Series appliances are at highest risk, as benefit of code execution at root level applies there. Virtualized firewalls in the VM-Series are susceptible to denial-of-service only. Cloud-based offerings like Prisma Access and Cloud NGFW are also impacted, though risk is reduced because external access is more constrained.
Affected Versions & Mitigations
The vulnerability affects multiple PAN-OS release branches: versions prior to 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10. Numerous maintenance builds in branches 10.2, 11.1, 11.2, and 12.1 are also vulnerable. Palo Alto recommends updating immediately to fixed releases, specifically PAN-OS 12.2.3 or above for the 12.2 branch.
No workaround currently exists, but there are steps organizations can take to reduce exposure. It’s advised to prevent management interfaces from being reachable from untrusted networks. Also, restrict management access to trusted internal IP addresses and use a dedicated jump box for administration where feasible. Palo Alto discovered this internally and, as of September 9, 2026, is not aware of any exploitation in the wild.
CVSS and Risk Ratings:The vulnerability carries a CVSS-Base Score of 9.2, indicating critical severity. Its exploitability is rated high in complexity but still alarming given its potential impact.
This vulnerability is part of a broader trend of XML parsers and similar components being exploited for remote code execution due to buffer overflows — especially in network infrastructure devices.
Analytical Angle:PAN-OS CVE-2026-0310 underscores the rising danger from flaws in network infrastructure that enable unauthenticated root access from the outside. Firewalls are critical gatekeepers, and compromise here is one step away from full enterprise breach. Organizations relying on Palo Alto hardware or virtual firewalls must treat this vulnerability like an imminent threat—delaying patches could open the door to serious attacks. Going forward, expect demands for better code auditing in firmware, tighter interface exposure controls, and perhaps independent assessments of firmware parsing logic. Your next move should be immediate patching, strict access controls, and enhanced monitoring of firewall behavior.
