Panorama Fixes Authenticated Administrator Remote Code Execution
Tech GuruQuick Answer
Restrict Panorama management access to trusted administration systems, apply the matching fixed PAN-OS build and validate management functions. Preserve administrator and configuration audit records.
Confirm Scope And Apply The Supported Remediation
What to do now: Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies. Confirm the device is Panorama and map its exact maintenance build to the advisory. Review administrator accounts, network reachability and external management exposure. Install the supported fixed Panorama build. The vendor lists no workaround and limited Threat Prevention coverage via IDs 510045 and 510048 in content 9171-10349 or later, requiring SSL decryption. Verify the running build, managed-device connectivity, configuration commits, log collection and approved administrative access.
Last verified: 2026-11-11 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PAN-OS on Panorama management systems |
|---|---|
| Advisory | CVE-2026-0330 |
| CVE | CVE-2026-0330 |
| Authoritative release date | November 11, 2026 at 17:00 UTC, from the vendor RSS entry and CSAF initial release timestamp. |
| Authority revision date | Initial publication on November 11, 2026; no separate material revision. CSAF generation timestamps are not treated as advisory revisions. |
| Affected versions | Panorama running PAN-OS 12.2, 12.1, 11.2, 11.1 or 10.2 at vulnerable builds listed below. An attacker requires authenticated administrator privileges and management network access. Standalone PAN-OS firewalls, Cloud NGFW and Prisma Access are unaffected. |
| Fixed version | PAN-OS 12.2.4-h2, 12.1.10-h4, 11.2.16-h2 or 11.1.16-h5, as applicable to the installed branch; PAN-OS 10.2.18-h14 for the 10.2 branch; alternate maintenance fixes are listed below |
| CVSS base score | 8.6 network / 8.4 restricted jump-box scenario (CVSS v4.0 base scores) |
| CVSS severity | High |
| Exploitation status | Palo Alto Networks states that it is not aware of malicious exploitation of this issue.; no exploitation claim is inferred. |
What Changed
An authenticated Panorama administrator with network access can execute code with root privileges. Restricting management access reduces exposure but does not replace the software fix.
What To Validate Now
- Inventory. Record product, exact running build, service owner, exposure path, relevant configuration and maintenance dependencies.
- Establish applicability. Confirm the device is Panorama and map its exact maintenance build to the advisory. Review administrator accounts, network reachability and external management exposure.
- Remediate. Install the supported fixed Panorama build. The vendor lists no workaround and limited Threat Prevention coverage via IDs 510045 and 510048 in content 9171-10349 or later, requiring SSL decryption.
- Validate. Verify the running build, managed-device connectivity, configuration commits, log collection and approved administrative access.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Preserve audit logs and configuration backups before maintenance. Test management compatibility and recovery; the required administrator privileges must remain explicit in incident assessment.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
Vendor Product and Build Matrix
Match each threshold to the corresponding maintenance branch. Multiple fixed builds are alternatives within their own maintenance lines; they are not a single cross-branch version range. Asterisks mark vendor-managed cloud maintenance, which must be confirmed with support.
| Product or branch | Affected builds | Unaffected builds |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 12.2 | < 12.2.4-h2 on Panorama | >= 12.2.4-h2 on Panorama |
| PAN-OS 12.1 | < 12.1.4-h14 on Panorama; < 12.1.7-h12 on Panorama; < 12.1.10-h4 on Panorama | >= 12.1.4-h14 on Panorama; >= 12.1.7-h12 on Panorama; >= 12.1.10-h4 on Panorama |
| PAN-OS 11.2 | < 11.2.4-h24 on Panorama; < 11.2.7-h24 on Panorama; < 11.2.10-h18 on Panorama; < 11.2.13-h5 on Panorama; < 11.2.16-h2 on Panorama | >= 11.2.4-h24 on Panorama; >= 11.2.7-h24 on Panorama; >= 11.2.10-h18 on Panorama; >= 11.2.13-h5 on Panorama; >= 11.2.16-h2 on Panorama |
| PAN-OS 11.1 | < 11.1.4-h39 on Panorama; < 11.1.6-h41 on Panorama; < 11.1.7-h13 on Panorama; < 11.1.10-h37 on Panorama; < 11.1.13-h17 on Panorama; < 11.1.16-h5 on Panorama | >= 11.1.4-h39 on Panorama; >= 11.1.6-h41 on Panorama; >= 11.1.7-h13 on Panorama; >= 11.1.10-h37 on Panorama; >= 11.1.13-h17 on Panorama; >= 11.1.16-h5 on Panorama |
| PAN-OS 10.2 | < 10.2.7-h40 on Panorama; < 10.2.10-h43 on Panorama; < 10.2.13-h28 on Panorama; < 10.2.16-h13 on Panorama; < 10.2.18-h14 on Panorama | >= 10.2.7-h40 on Panorama; >= 10.2.10-h43 on Panorama; >= 10.2.13-h28 on Panorama; >= 10.2.16-h13 on Panorama; >= 10.2.18-h14 on Panorama |
| Prisma Access | None | All |
Score Interpretation and First-Party Evidence
Base scores and severities above come from the vendor-hosted JSON. The page also displays threat-adjusted CVSS-BT scores; those are different metrics and are not substituted for the base scores.
