CVE-2026-0320 PAN-OS: Authenticated Admin Command Injection Vulnerability
Authenticated administrators can execute arbitrary root commands on PAN-OS firewalls, requiring management interface access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-0320?
CVE-2026-0320 is a medium-severity command injection vulnerability in Palo Alto Networks Cloud NGFW, published on 14 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interface.
The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Weakness: CWE-78
Which versions are affected by CVE-2026-0320?
How do I fix CVE-2026-0320?
No fix has been published for CVE-2026-0320 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-0320 being exploited?
There is no known exploitation of CVE-2026-0320 in the wild and no public exploit code.
Sources
Also known as GHSA-m59r-x8f9-j875.