Palo Alto says HIGHEST urgency — root risk on PA-Series firewalls

Palo Alto stamped this one Suggested Urgency: HIGHEST. An unauthenticated attacker who can reach the management web or data plane can crash VM-Series or run code as root on PA-Series hardware. Panorama is in scope too. Palo Alto knows of no exploitation yet, which leaves time to upgrade first.

No known exploit yet. Use the time to upgrade.

CVE-2026-0310: an XML overflow that reaches root on PA-Series

CVE-2026-0310 is a buffer overflow in PAN-OS XML processing (CWE-787), published September 9, 2026. No special configuration is required to be affected. Impact splits by platform: PA-Series hardware faces arbitrary code execution as root (CVSS-B 9.2); VM-Series is primarily denial of service; Prisma Access and Cloud NGFW are lower (authenticated / restricted paths) and Palo Alto is upgrading those on the maintenance cycle.

Fixed trains are published per minor branch (examples: 12.2.3+, 12.1.10 / 12.1.7-h5 / 12.1.4-h10, and matching 11.2 / 11.1 / 10.2 hotfixes). Palo Alto reports no known malicious exploitation as of the advisory, so teams can still upgrade ahead of any attacks.

Root on the firewall means policy, VPN and decryption

Too many next-gen firewalls still expose management or dataplane listeners to the open Internet. Root on a PA-Series box gives an attacker its policy, VPN and decryption, plus a foothold in the network behind it. The vendor rates urgency HIGHEST and knows of no exploit yet. Finish the upgrade now, before the scanning starts.

Match every box to its fixed build, then lock down management

• Inventory PAN-OS versions across PA-Series, VM-Series, and Panorama; map each to the fixed build in the advisory table.
• Upgrade to the listed fixed release for your train; check the exact -h build instead of assuming a recent hotfix covers it.
• Restrict management interface access to a jump box or trusted networks. Palo Alto says following its best-practice guidance lowers the risk even before the patch.
• Confirm dataplane/management exposure with external attack-surface scans; close anything that should never have been public.
• Prisma Access / Cloud NGFW: verify Palo Alto’s scheduled upgrade or open an on-demand window with support if you need it sooner.

Forward this — Firewall owners: map every PAN-OS box to the fixed build in the advisory, take the upgrade, and lock management to a jump box while you do it.

Details

• CVE: CVE-2026-0310 — Out-of-bounds write via XML processing
• Impact: Unauth DoS (VM-Series) / unauth root RCE (PA-Series); Panorama impacted
• Urgency: HIGHEST (vendor)
• Exploit status: No known malicious exploitation (per Palo Alto)
• Workarounds: None known; network restriction reduces exposure
• Advisory: https://security.paloaltonetworks.com/CVE-2026-0310

Hunt / verify

• Record pre-upgrade PAN-OS version strings and confirm post-upgrade builds match the unaffected column.
• Review management and system logs for anomalous XML/API traffic to management or dataplane listeners in the pre-patch window.
• Check management ACLs after the change. The fix is the patch plus less exposure.

Map PA/VM/Panorama versions to fixed builds; upgrade; restrict mgmt to jump box; confirm no public management listeners.

Sources

• https://security.paloaltonetworks.com/CVE-2026-0310
• https://nvd.nist.gov/vuln/detail/CVE-2026-0310

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].