Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5840 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-0330 Panorama Config Value Containing Shell Injection Metacharacters — Exploitation

Behaviour-first detection of the CWE-94 code-injection pattern behind CVE-2026-0330 (PAN-OS on Panorama, authenticated admin to root). Fires when a Panorama config-log change (set/edit/add/commit) carries shell command-substitution or command-chaining metacharacters in an admin-supplied value. The vendor reports no known exploitation and no public PoC, so this is a heuristic for the injection class, not a signature of a known payload.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T1068
• Data sources: palo_alto_panorama_config_logs, splunk_add_on_palo_alto_networks:pan:config, sentinel_commonsecuritylog_cef
• Severity: high
• Confidence: medium

Splunk SPL

index=pan_logs sourcetype="pan:config" earliest=-24h
```comment
CVE-2026-0330: shell/code-injection metacharacters supplied by an admin in Panorama config values (CWE-94)
```
| where match(lower(cmd),"^(set|edit|add|commit)$")
| eval payload=coalesce(after_change_detail, path, _raw)
| where match(payload,"(\x24\x28|\x60|;\s*(sh|bash|curl|wget|nc|python|perl)\b|\|\s*(sh|bash)\b|&&\s*(curl|wget|sh|bash)\b|/dev/tcp/)")
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as cmds values(path) as paths by admin, host, client
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen admin host client cmds paths count

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ "Palo Alto Networks" and DeviceProduct =~ "PAN-OS"
| where Activity =~ "CONFIG"
| extend Payload = strcat(Message, " ", AdditionalExtensions)
| where Payload matches regex @"(\x24\x28|\x60|;\s*(sh|bash|curl|wget|nc|python|perl)\b|\|\s*(sh|bash)\b|&&\s*(curl|wget|sh|bash)\b|/dev/tcp/)"
| project TimeGenerated, DeviceName, SourceUserName, SourceIP, Activity, Message, Payload

Sigma

title: Panorama Config Value With Shell Metacharacters - CVE-2026-0330
id: 7b1f3c52-4a0e-4d6b-9c1d-5e8a2f6d0a11
status: experimental
description: Detects Panorama configuration changes whose values contain shell command-injection metacharacters, consistent with CWE-94 code injection against PAN-OS on Panorama (CVE-2026-0330).
references:
  - https://security.paloaltonetworks.com/CVE-2026-0330
  - https://cwe.mitre.org/data/definitions/94.html
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026.0330
logsource:
  product: paloalto
  service: config
detection:
  selection_cmd:
    cmd:
      - set
      - edit
      - add
  selection_payload:
    after_change_detail|contains:
      - '$('
      - '`'
      - '/dev/tcp/'
      - '; sh'
      - '; bash'
      - '; curl'
      - '; wget'
      - '| sh'
      - '| bash'
      - '&& curl'
      - '&& wget'
  condition: selection_cmd and selection_payload
falsepositives:
  - Administrators storing legitimate scripts, regexes or custom URL patterns in config fields
level: high

Known false positives:

• Administrators saving legitimate scripts, regexes or URL patterns in config fields
• Automation or IaC tooling that pushes templated config containing shell-like characters

Tuning notes: Confirm Panorama forwards config logs to the pan_logs index (adjust index/sourcetype to your environment). Exclude known automation admin accounts and trim the regex to metacharacters that never occur in your legitimate config values. Pair with the Threat ID 510045/510048 detection; the vendor reports no known exploitation, so treat hits as hunt leads.

• 🔒 CVE-2026-0330 Threat Prevention Signature 510045/510048 Hit — Exploitation · unlock with TL Creds
• 🔒 Panorama Log Forwarding or Syslog Configuration Tampering — Post-Exploitation · unlock with TL Creds
• 🔒 Sentinel Hunt: Panorama-Related CVE-2026-0322 Exploitation Infrastructure — C2/Access · unlock with TL Creds
• 🔒 Panorama Admin Login From Public IP Address — Exploitation Precondition · unlock with TL Creds
• 🔒 Panorama Configuration Export — Post-Exploitation Collection · unlock with TL Creds
• 🔒 Firewall Traffic Involving CVE-2026-0322-Linked IPs Against PAN-OS — C2/Access · unlock with TL Creds
• 🔒 Panorama Administrator, Role or Authentication Profile Modification — Post-Exploitation · unlock with TL Creds
• 🔒 Panorama-Related Infrastructure From CVE-2026-0322 Exploitation Attempts — C2/Access · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5840.

Sample indicators (3 of 12)

• IP address: 66.42.72[.]14
• IP address: 208.83.239[.]114
• IP address: 149.248.47[.]234

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

Technical analysis

CVE-2026-0330 is a remote code execution vulnerability in PAN-OS on Panorama (Palo Alto Networks' centralized management platform). An authenticated administrator with network access to the management interface can inject code that executes with root privileges, i.e. beyond the normal limits of the administrator role. No special configuration is required for a Panorama to be vulnerable, and no user interaction is needed. The weakness is classified as CWE-94 (Improper Control of Generation of Code) / CAPEC-242 (Code Injection).

Scoring: the vendor publishes CVSS v4.0 only. CVSS-B (base) is 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H); the threat-adjusted CVSS-BT is 6.1 (MEDIUM) because exploit maturity is Unreported (E:U), with provider urgency Amber and MODERATE suggested urgency. This record uses the base score 8.6 (HIGH). A jump-box scenario (management reachable only locally via a jump box) scores CVSS-B 8.4 / CVSS-BT 5.7. Risk is highest when the management interface is reachable from external internet addresses. Automatable: No; response effort: Moderate.

Scope: only PAN-OS on Panorama is affected. Cloud NGFW, Prisma Access and standalone PAN-OS firewalls are stated as not impacted. Fixed builds: 12.2.4-h2; 12.1.4-h14, 12.1.7-h12, 12.1.10-h4; 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2; 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5; 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14. Unsupported older versions must move to a supported fixed release.

There is no known workaround. Restricting management access to trusted internal IPs (ideally via a jump box) reduces exposure but does not replace patching. Threat Prevention subscribers get limited coverage via Threat IDs 510045 and 510048 (Applications and Threats content 9171-10349 or later), which requires SSL decryption. The flaw was found internally and credited to Palo Alto Networks researcher Daniel Voce. No public PoC, IOCs or attribution are reported.

Related but separate: CVE-2026-0322, an earlier PAN-OS management-interface code injection (CWE-94, CVSS 4.0 8.6, advisory 2026-10-14, reported by Suraj Siddharudh) for which the vendor confirmed very limited exploitation. Exploitation of CVE-2026-0322 is not evidence of exploitation of CVE-2026-0330. Because Panorama is a high-value management plane, defenders should audit administrator accounts and management-interface exposure.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts

Privilege Escalation

T1078 Valid Accounts

Defense Evasion

T1078 Valid Accounts

Remediation

Patches

• 12.2.4-h2
• 12.1.4-h14, 12.1.7-h12, 12.1.10-h4
• 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2
• 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5
• 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14

Immediate actions

• Upgrade Panorama to a fixed release for your branch (e.g. 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5, 10.2.18-h14)
• Restrict Panorama management interface access to trusted internal IP addresses, ideally via a dedicated jump box
• Ensure Panorama and firewall management interfaces are not reachable from the internet or untrusted networks

Workarounds

• No known workaround exists
• Limited coverage: enable Threat Prevention Threat IDs 510045 and 510048 (content 9171-10349 or later; requires SSL Decryption)

Longer-term hardening

• Move unsupported PAN-OS versions to a supported, fixed release
• Review and minimize Panorama administrator accounts and audit administrator activity
• Monitor Panorama for unexpected process execution and config changes

Affected and fixed versions

• Palo Alto Networks — PAN-OS (Panorama)
  Vulnerable versions: 12.2 before 12.2.4-h2; 12.1 before 12.1.4-h14 / 12.1.7-h12 / 12.1.10-h4; 11.2 before 11.2.4-h24 / 11.2.7-h24 / 11.2.10-h18 / 11.2.13-h5 / 11.2.16-h2; 11.1 before 11.1.4-h39 / 11.1.6-h41 / 11.1.7-h13 / 11.1.10-h37 / 11.1.13-h17 / 11.1.16-h5; 10.2 before 10.2.7-h40 / 10.2.10-h43 / 10.2.13-h28 / 10.2.16-h13 / 10.2.18-h14; Older unsupported PAN-OS versions on Panorama
  Fixed in: 12.2.4-h2; 12.1.4-h14; 12.1.7-h12; 12.1.10-h4; 11.2.4-h24; 11.2.7-h24; 11.2.10-h18; 11.2.13-h5; 11.2.16-h2; 11.1.4-h39
• Palo Alto Networks — Cloud NGFW, Prisma Access, standalone PAN-OS firewalls (NOT affected)

Timeline

• 2026-10-14 Palo Alto Networks publishes advisory for related, separate PAN-OS root code injection CVE-2026-0322 with very limited exploitation confirmed
• 2026-10-15 Press coverage of CVE-2026-0322 lists three IPs tied to exploitation attempts of that separate flaw
• 2026-11-11 Threat Prevention Threat IDs 510045 and 510048 (content 9171-10349 or later) provide limited coverage when SSL Decryption is enabled
• 2026-11-11 CVE-2026-0330 published in NVD (status Awaiting Analysis) with vendor CVSS v4.0 base 6.1 (threat-adjusted) and CWE-94
• 2026-11-11 Palo Alto Networks publishes advisory CVE-2026-0330 (Panorama authenticated RCE as root) with fixed releases; internal discovery by Daniel Voce; vendor not aware of malicious exploitation
• 2026-11-12 Cyber Security News reports the flaw and fixed releases; no exploitation, PoC, IOCs or attribution reported

Sources cited

• NVD - CVE-2026-0330 NVD (NIST) · Advisory · 2026-11-11
• Palo Alto Networks Security Advisory CVE-2026-0330: PAN-OS Authenticated RCE in Panorama Palo Alto Networks · Vendor report · 2026-11-11
• CWE-94: Improper Control of Generation of Code ('Code Injection') MITRE · Research · 2026-11-11
• CAPEC-242: Code Injection MITRE · Research · 2026-11-11
• Palo Alto PAN-OS RCE Flaw Allows Attackers to Execute Arbitrary Code With Root Privileges (Cyber Security News) cybersecuritynews.com · News · 2026-11-12
• Cyber Security News - PAN-OS vulnerability CVE-2026-0322 (related, separate issue; exploited) cybersecuritynews.com · News · 2026-10-15

More in vulnerability

• SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege Escalation to SYSTEM (No CVE)
• Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
• Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)
• Dirty Cert: Cisco Smart Software Manager Silently Patched Post-Auth RCE via Certificate Upload (no CVE stated)

Related coverage of this activity

Other reports on CVE-2026-0322

• Eclypsium InfraTrust Pulse (Oct 2026): Actively Exploited Flaws Across Network Infrastructure Appliances (NetScaler CVE-2026-88771, Ivanti CVE-2026-104935, Check Point CVE-2026-93616, Cisco, Arista VeloCloud, FortiMail, F5 BIG-IP APM, PAN-OS, PHP2Shell, Linux Copy Fail)
• CISA KEV: Exploited Flaws in Palo Alto PAN-OS (CVE-2026-0322), Cisco Secure Email Gateway (CVE-2026-76519) and Ahsay AhsayCBS (CVE-2026-105133, CVE-2026-105134)