CVE-2026-0310: PAN-OS Buffer Overflow Can Enable Root RCE on PA-Series Firewalls

Palo Alto Networks has released security updates for a high-severity buffer overflow vulnerability affecting PAN-OS software. Tracked as CVE-2026-0310, the issue resides in XML processing functionality and can allow an unauthenticated remote attacker to cause a denial-of-service condition on VM-Series firewalls or execute arbitrary code with root privileges on vulnerable PA-Series hardware firewalls.

The flaw requires no special configuration to be present. An attacker only needs network access to the affected management web interface or dataplane interface, making exposure particularly concerning when administrative interfaces can be reached from untrusted networks. Palo Alto Networks recommends restricting management access to trusted internal addresses as a fundamental risk-reduction measure.

Palo Alto Networks rates the vulnerability High, with a CVSS-BT score of 7.2 and a CVSS base score of 9.2 for the highest-risk PA-Series scenario. The vendor assigns its highest suggested remediation urgency because successful exploitation against physical firewalls can result in privileged arbitrary code execution.

The PAN-OS buffer overflow flaw threatens organizations running affected firewall software across multiple supported branches, although its consequences vary depending on the deployment model. At disclosure on September 9, 2026, Palo Alto Networks said it was not aware of malicious exploitation.

Contact Sales

CVE-2026-0310 analysis

From a defensive perspective, CVE-2026-0310 analysis starts with understanding the vulnerable XML-processing path. Palo Alto Networks classifies the underlying weakness as CWE-787: Out-of-Bounds Write, a memory-safety problem in which specially crafted input can cause data to be written beyond the intended memory boundary.

The vulnerability can be reached through either the management web interface or the dataplane interface. No authentication is required in the PA-Series and VM-Series scenarios described by the vendor, and no user interaction is necessary. The attack complexity for the PA-Series scenario is rated high, meaning reliable exploitation requires additional conditions or precise manipulation of the vulnerable processing path.

The most important details for CVE-2026-0310 concern the difference between hardware and virtual firewalls.

On PA-Series hardware firewalls, successful exploitation can result in arbitrary code execution with root privileges. Root access would give an attacker extensive control over the firewall and potentially allow manipulation of security policy, access to sensitive configuration, persistence, disruption of network traffic, or use of the appliance as a foothold for further intrusion.

On VM-Series firewalls, Palo Alto Networks states that the impact is limited to denial of service. The vendor rates this scenario Medium, with CVSS-BT 6.6 and a base score of 8.7. Successful exploitation could disrupt firewall availability but is not documented as providing arbitrary code execution on VM-Series appliances.

Palo Alto Networks also confirms that Panorama is impacted by the vulnerability. Organizations using Panorama to centrally manage firewall estates should therefore include those systems in their version and exposure assessment rather than evaluating only individual firewalls.

CVE-2026-0310 affects supported PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 branches prior to their respective fixed builds. Prisma Access and Cloud NGFW deployments are also listed as affected, although Palo Alto Networks considers exploitation risk lower in those environments because authentication is required and external network access is restricted.

For PAN-OS 12.2, releases earlier than 12.2.3 are vulnerable. PAN-OS 12.1 deployments require one of the appropriate patched builds, including 12.1.4-h10, 12.1.7-h5, or 12.1.10, depending on the maintenance branch.

PAN-OS 11.2 fixes include:

• 11.2.4-h21
• 11.2.7-h20
• 11.2.10-h14
• 11.2.13-h2

Palo Alto Networks’ release documentation explicitly confirms that builds such as 11.2.7-h20 and 11.2.10-h14 contain the fix.

For PAN-OS 11.1, fixed maintenance releases include 11.1.4-h36, 11.1.6-h38, 11.1.7-h10, 11.1.10-h33, 11.1.13-h12, and 11.1.16-h2.

PAN-OS 10.2 customers have fixes available in 10.2.7-h37, 10.2.10-h40, 10.2.13-h24, 10.2.16-h10, and 10.2.18-h10, depending on the release branch. Unsupported older PAN-OS versions should be migrated to a supported fixed version.

Prisma Access customers are protected beginning with 12.1.7-h5, 11.2.7-h20, or 10.2.10-h40, depending on their deployed version. Palo Alto Networks plans to upgrade Prisma Access and Cloud NGFW customers during scheduled maintenance cycles and allows customers requiring earlier remediation to arrange an on-demand upgrade.

Unlike many vulnerabilities whose exploitation depends on an optional feature being enabled, Palo Alto Networks explicitly states that no special configuration is required for a PAN-OS system to be affected. Exposure instead depends on whether an attacker can establish network connectivity to the vulnerable management or dataplane interface.

Restricting the management interface to a dedicated jump box significantly lowers practical risk. Palo Alto Networks calculates a reduced CVSS-BT score of 5.2 for this scenario because the attacker must first gain access to the trusted management network before reaching the vulnerable interface.

The vulnerability was discovered internally by Palo Alto Networks’ security research teams. The vendor has not disclosed the exact internal discovery date, but the advisory was published on September 9, 2026.

At the time of disclosure, Palo Alto Networks classified exploit maturity as unreported and stated that it had no knowledge of malicious exploitation. A vendor-backed CVE-2026-0310 PoC has not been published, and the advisory does not provide sufficiently detailed packet-level information to reproduce the vulnerability reliably.

Similarly, there are currently no campaign-specific CVE-2026-0310 IOCs because the vendor has not observed attacks associated with the flaw. Defenders should therefore concentrate on exposure assessment, version verification, management-interface access, abnormal service behavior, and unexpected firewall activity rather than waiting for malicious IP addresses or payload hashes.

CVE-2026-0310 Mitigation

The primary CVE-2026-0310 mitigation is to upgrade PAN-OS to the appropriate fixed maintenance release for the organization’s current software branch. Palo Alto Networks explicitly states that no known workaround exists, making software updates the only complete vendor-supported remediation.

Organizations should prioritize PA-Series hardware appliances because these systems face the most severe documented outcome: unauthenticated arbitrary code execution with root privileges.

At a minimum, affected organizations should upgrade to the appropriate fixed release:

• PAN-OS 12.2: 12.2.3 or later
• PAN-OS 12.1: 12.1.4-h10, 12.1.7-h5, 12.1.10, or later as appropriate
• PAN-OS 11.2: 11.2.4-h21, 11.2.7-h20, 11.2.10-h14, 11.2.13-h2, or later
• PAN-OS 11.1: the applicable fixed hotfix branch up to 11.1.16-h2 or later
• PAN-OS 10.2: the applicable fixed hotfix branch up to 10.2.18-h10 or later
• Unsupported PAN-OS: migrate to a supported fixed version

CVE-2026-0310 detection should begin with identifying every PAN-OS firewall and Panorama appliance in the environment, recording its exact software version, and determining whether the management or dataplane interfaces are reachable from untrusted networks.

Security teams should give particular attention to devices where the management interface is exposed broadly rather than restricted to trusted administrative addresses.

To Detect CVE-2026-0310 exploitation attempts or suspicious post-compromise activity, defenders should investigate:

• Unexpected connections to PAN-OS management interfaces from untrusted sources
• Repeated malformed or unusual traffic reaching management or dataplane services
• Unexpected crashes or restarts affecting VM-Series appliances
• Abnormal PAN-OS processes or service instability following s

Key Takeaways

• CVE-2026-0310 is a buffer overflow vulnerability in PAN-OS that allows unauthenticated remote attackers to cause denial-of-service on VM-Series firewalls or execute arbitrary code as root on PA-Series hardware firewalls. The flaw requires no special configuration and can be exploited through the management or dataplane interface. Organizations should restrict management access to trusted networks immediately.
• Palo Alto Networks has assigned CVE-2026-0310 a CVSS-BT score of 7.2 and a base score of 9.2 for the highest-risk PA-Series scenario, indicating the severity of the flaw. Successful exploitation on physical firewalls leads to privileged arbitrary code execution. The vendor urges applying security updates with the highest remediation urgency.
• The vulnerability affects multiple supported PAN-OS branches and has a high potential impact on organizations running vulnerable firewalls. An attacker only needs network access to the affected interfaces, making exposure from untrusted networks particularly dangerous. Palo Alto Networks recommends restricting management access to trusted internal addresses as a key risk-reduction measure.