This vulnerability (CWE-862) in Palo Alto Networks PAN-OS software permits an authenticated administrator with CLI access to escalate privileges to root level on PA-Series, VM-Series firewalls, and Panorama (virtual and M-Series). The issue does not impact Cloud NGFW or Prisma Access. The vulnerability arises from missing authorization controls in the CLI interface, enabling privilege escalation. The vendor recommends limiting CLI access and restricting management interface access to trusted internal IP addresses as a best practice to minimize risk. No official fix or patch has been disclosed as of the publication date.

An authenticated administrator with CLI access can gain root privileges, potentially allowing full control over the affected device. This could lead to unauthorized configuration changes or disruption of firewall operations. The impact is mitigated if CLI access is tightly controlled and restricted to trusted administrators and internal IP addresses. Cloud NGFW and Prisma Access are not affected, limiting the scope to on-premises and virtual firewall deployments.

No official patch or fix has been confirmed at this time. The vendor recommends following best practice deployment guidelines by restricting CLI access to a limited group of administrators and limiting management interface access to trusted internal IP addresses. Organizations should implement these access controls to reduce the risk of exploitation until a patch or official remediation is available. Monitor vendor advisories for updates on remediation.