CVE-2026-0310: PAN-OS Buffer Overflow Flaw Allows Execute Arbitrary Code with Root Privileges
Do Son 
Palo Alto Networks disclosed a high-severity PAN-OS buffer overflow flaw today. This vulnerability allows unauthenticated remote attackers to execute code with root privileges or cause denial of service conditions. Consequently, administrators must patch affected firewalls immediately to prevent potential system compromise.
Why This Matters
Industry estimates indicate that Palo Alto Networks firewalls protect over 80,000 enterprise organizations worldwide. Therefore, this PAN-OS buffer overflow flaw threatens a massive number of corporate networks. By achieving root privileges, an attacker gains total control over the firewall infrastructure. This access exposes sensitive internal networks to severe data breaches and widespread disruption.
How the Attack Works
The attack targets the XML processing feature within the firewall software. According to the official advisory, “A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls.” The attacker simply sends maliciously crafted XML requests to the exposed interface.
Affected Versions
This vulnerability impacts numerous software versions across different firewall models. Affected products include PAN-OS versions 10.2, 11.1, 11.2, 12.1, and 12.2. Additionally, the flaw affects Cloud NGFW instances on AWS and Azure, alongside Prisma Access deployments.
Patch and Mitigation Steps
Security researchers have not confirmed any active exploitation in the wild. Likewise, no public proof-of-concept exploit currently exists. Administrators should upgrade to a fixed release, such as PAN-OS 12.2.3, 12.1.10, or 11.2.13-h2. Furthermore, you can reduce your exposure by restricting management interface access to trusted internal IP addresses only.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
