CVE-2026-0320: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Palo Alto Networks Cloud NGFW
Description
CVE-2026-0320 is a command injection vulnerability in Palo Alto Networks PAN-OS software that allows an authenticated administrator to execute arbitrary commands as root. Exploitation requires access to the PAN-OS management interface. The vulnerability affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), but not Cloud NGFW or Prisma Access. Restricting management interface access to trusted internal IP addresses significantly reduces risk. The vulnerability has a medium severity with a CVSS 4.0 score of 6.1.
CVSS v4.0
Score 6.1medium
Affected software
Palo Alto Networks
Cloud NGFW
Palo Alto Networks
PAN-OS
Palo Alto Networks
Prisma Access
pkg:github/paloaltonetworks/panosRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-0320) is an OS command injection flaw (CWE-78) in Palo Alto Networks PAN-OS software. It enables an authenticated administrator with access to the management interface to bypass system restrictions and run arbitrary commands as the root user. The issue affects multiple PAN-OS versions on PA-Series, VM-Series firewalls, and Panorama devices. Cloud NGFW and Prisma Access are not affected. The risk is mitigated by restricting management interface access to trusted internal IPs as per Palo Alto Networks' best practices.
Potential Impact
An authenticated administrator with access to the management interface can execute arbitrary commands as root, potentially leading to full system compromise. However, the vulnerability requires high privileges and network access to the management interface, which is typically restricted. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
Mitigation Recommendations
Restrict access to the PAN-OS management interface to trusted internal IP addresses following Palo Alto Networks' recommended best practice deployment guidelines. Check the vendor advisory for official patches or updates. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- palo_alto
- Date Reserved
- 2025-11-03T20:45:18.580Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acfe7382cdf04f656ad1929
Added to database: 10/14/2026, 20:34:00 UTC
Last enriched: 10/14/2026, 20:48:37 UTC
Last updated: 10/14/2026, 20:49:11 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.