This vulnerability (CWE-78) in Palo Alto Networks PAN-OS software permits an authenticated administrator with CLI or Web UI access to bypass system restrictions and execute arbitrary OS commands with root privileges. It affects on-premises PA-Series and VM-Series firewalls and Panorama (virtual and M-Series) but explicitly excludes Cloud NGFW and Prisma Access. The vulnerability requires high privileges (administrator access) and no user interaction. The CVSS 4.0 base score is 6.1 (medium severity). No official patch or remediation level is currently provided, and no known exploits are reported in the wild. Vendor best practices recommend restricting CLI and management interface access to trusted internal IPs and a limited administrator group to mitigate risk.

An authenticated administrator can execute arbitrary commands as root on affected PAN-OS devices, potentially leading to full system compromise. However, exploitation requires high privileges (administrator access) and access to management interfaces. The impact is significant on affected devices but does not affect Palo Alto Networks Cloud NGFW or Prisma Access services.

No official patch or remediation level is currently confirmed. The vendor recommends following best practice deployment guidelines by restricting CLI access to a limited group of administrators and limiting management web interface access to trusted internal IP addresses. These measures significantly reduce the risk of exploitation. Monitor the vendor advisory for updates on patch availability.