CVE-2026-0272High· 7.2▾ TwilightA privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges. The security risk…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges.
The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
pan-os >= 10.2.0, < 10.2.7pan-os >= 10.2.8, < 10.2.10pan-os >= 10.2.11, < 10.2.13pan-os >= 10.2.14, < 10.2.16pan-os = 10.2.7pan-os = 10.2.10pan-os = 10.2.13pan-os = 10.2.16pan-os = 10.2.17pan-os = 10.2.18pan-os >= 11.1.0, < 11.1.4pan-os >= 11.1.8, < 11.1.10pan-os >= 11.1.11, < 11.1.13pan-os = 11.1.4pan-os = 11.1.5pan-os = 11.1.6pan-os = 11.1.7pan-os = 11.1.10pan-os = 11.1.13pan-os >= 11.2.0, < 11.2.4pan-os >= 11.2.5, < 11.2.7pan-os >= 11.2.8, < 11.2.10pan-os = 11.2.4pan-os = 11.2.7pan-os = 11.2.10pan-os >= 12.1.2, < 12.1.4pan-os = 12.1.4Upgrade past the affected range:
pan-os 12.1.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-0322High· 7.2A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The s…
CVE-2025-12924Medium· 4.3A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224
CVE-2019-1579High· 8.1Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute a…
CVE-2026-0286High· 7.2A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly m…
CVE-2026-0285Medium· 4.9A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to intern…
CVE-2026-0284Critical· 9.9An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to informatio…