CVE-2026-0330: Panorama Access and Patch Verification

Palo Alto Networks rates CVE-2026-0330 Medium (CVSS 4.0 6.1). On Panorama, an authenticated administrator with network access can exploit a code-injection flaw in PAN-OS to execute arbitrary code with root privileges. The high-privilege prerequisite matters when assessing likely attack paths, but does not remove a vulnerable Panorama instance from the patch queue. Palo Alto Networks says it is not aware of malicious exploitation.

Scope is narrower than PAN-OS firewalls: the vendor identifies PAN-OS running on Panorama as affected, while Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls are not affected by this issue. Confirm the product role before applying the version table.

Choose the fixed branch for the exact release

Palo Alto Networks provides multiple fixed maintenance branches in each supported train. Select a target from the matching row in the current advisory; a higher-looking version in a different train is not a substitute. Thresholds below are the vendor-listed fixed releases checked November 13, 2026.

Prioritize the management path and privileged access

The vendor says risk is highest when Panorama management access is allowed from external internet addresses and recommends restricting it to trusted internal sources, ideally through a controlled jump host. This is exposure reduction, not a software fix. The advisory says no special configuration is required to be affected, so do not treat an optional feature as an exclusion.

• Inventory each Panorama instance by deployment identifier, role, HA/DR relationship, PAN-OS train, and exact running build.
• Map permitted management sources and routes, including jump hosts and administrative automation. Record whether any path is internet reachable.
• Prioritize externally reachable management interfaces and privileged-account exposure, while keeping every affected Panorama build in the remediation plan.
• Choose a vendor-listed fixed release for that same train, then follow the supported upgrade path.

Separate mitigation from closure evidence

Palo Alto Networks lists no known workaround. Customers with Threat Prevention may enable Threat IDs 510045 and 510048 from Applications and Threats content version 9171-10349 or later for limited coverage; SSL decryption is required. The vendor describes this as coverage, not a replacement for fixed PAN-OS.

For each instance, retain pre-change and post-change running version, matching train, selected fixed target, change record, completion time, and a normal management and service-health check. For HA deployments, verify both peers and record the post-change state after any required failover. A successful deployment task does not prove every instance runs the fixed build.

The official Penligent 3.0 video below demonstrates a general AI-assisted testing workflow. It does not reproduce CVE-2026-0330 or validate a Panorama patch.

Method: AI-assisted review of Palo Alto Networks advisory PAN-SA-2026-0007 and its published CVE record on November 13, 2026. This is a source-based assessment; no independent exploit test or customer-system validation is claimed.

For the related but distinct PAN-OS PHP2Shell issue, see our PAN-OS PHP2Shell exposure and patch checks. Keep each CVE’s affected product and advisory status separate.