# Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330

> A code injection flaw (CWE-94) in PAN-OS running on Panorama lets an authenticated administrator with network access execute arbitrary code as root. Palo Alto Networks published fixes on 2026-11-11 and states it is not aware of malicious exploitation.

- **Published:** 2026-11-12T08:30:39Z
- **Last reviewed:** 2026-11-12T08:30:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5840
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5840.png
- **ID:** TL-2026-5840
- **Severity:** HIGH (CVSS 8.6)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (3 shown free below)
- **CVEs:** CVE-2026-0330, CVE-2026-0322

## Description

CVE-2026-0330 is a remote code execution vulnerability in PAN-OS on Panorama (Palo Alto Networks' centralized management platform). An authenticated administrator with network access to the management interface can inject code that executes with root privileges, i.e. beyond the normal limits of the administrator role. No special configuration is required for a Panorama to be vulnerable, and no user interaction is needed. The weakness is classified as CWE-94 (Improper Control of Generation of Code) / CAPEC-242 (Code Injection).

Scoring: the vendor publishes CVSS v4.0 only. CVSS-B (base) is 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H); the threat-adjusted CVSS-BT is 6.1 (MEDIUM) because exploit maturity is Unreported (E:U), with provider urgency Amber and MODERATE suggested urgency. This record uses the base score 8.6 (HIGH). A jump-box scenario (management reachable only locally via a jump box) scores CVSS-B 8.4 / CVSS-BT 5.7. Risk is highest when the management interface is reachable from external internet addresses. Automatable: No; response effort: Moderate.

Scope: only PAN-OS on Panorama is affected. Cloud NGFW, Prisma Access and standalone PAN-OS firewalls are stated as not impacted. Fixed builds: 12.2.4-h2; 12.1.4-h14, 12.1.7-h12, 12.1.10-h4; 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2; 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5; 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14. Unsupported older versions must move to a supported fixed release.

There is no known workaround. Restricting management access to trusted internal IPs (ideally via a jump box) reduces exposure but does not replace patching. Threat Prevention subscribers get limited coverage via Threat IDs 510045 and 510048 (Applications and Threats content 9171-10349 or later), which requires SSL decryption. The flaw was found internally and credited to Palo Alto Networks researcher Daniel Voce. No public PoC, IOCs or attribution are reported.

Related but separate: CVE-2026-0322, an earlier PAN-OS management-interface code injection (CWE-94, CVSS 4.0 8.6, advisory 2026-10-14, reported by Suraj Siddharudh) for which the vendor confirmed very limited exploitation. Exploitation of CVE-2026-0322 is not evidence of exploitation of CVE-2026-0330. Because Panorama is a high-value management plane, defenders should audit administrator accounts and management-interface exposure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-0330 Panorama Config Value Containing Shell Injection Metacharacters — Exploitation** (`TL-2026-5840-SPL-001`)

Behaviour-first detection of the CWE-94 code-injection pattern behind CVE-2026-0330 (PAN-OS on Panorama, authenticated admin to root). Fires when a Panorama config-log change (set/edit/add/commit) carries shell command-substitution or command-chaining metacharacters in an admin-supplied value. The vendor reports no known exploitation and no public PoC, so this is a heuristic for the injection class, not a signature of a known payload.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1068
- **Data sources:** palo_alto_panorama_config_logs, splunk_add_on_palo_alto_networks:pan:config, sentinel_commonsecuritylog_cef
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

````spl
index=pan_logs sourcetype="pan:config" earliest=-24h
```comment
CVE-2026-0330: shell/code-injection metacharacters supplied by an admin in Panorama config values (CWE-94)
```
| where match(lower(cmd),"^(set|edit|add|commit)$")
| eval payload=coalesce(after_change_detail, path, _raw)
| where match(payload,"(\x24\x28|\x60|;\s*(sh|bash|curl|wget|nc|python|perl)\b|\|\s*(sh|bash)\b|&&\s*(curl|wget|sh|bash)\b|/dev/tcp/)")
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as cmds values(path) as paths by admin, host, client
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen admin host client cmds paths count
````

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor =~ "Palo Alto Networks" and DeviceProduct =~ "PAN-OS"
| where Activity =~ "CONFIG"
| extend Payload = strcat(Message, " ", AdditionalExtensions)
| where Payload matches regex @"(\x24\x28|\x60|;\s*(sh|bash|curl|wget|nc|python|perl)\b|\|\s*(sh|bash)\b|&&\s*(curl|wget|sh|bash)\b|/dev/tcp/)"
| project TimeGenerated, DeviceName, SourceUserName, SourceIP, Activity, Message, Payload
```

### Sigma

```yaml
title: Panorama Config Value With Shell Metacharacters - CVE-2026-0330
id: 7b1f3c52-4a0e-4d6b-9c1d-5e8a2f6d0a11
status: experimental
description: Detects Panorama configuration changes whose values contain shell command-injection metacharacters, consistent with CWE-94 code injection against PAN-OS on Panorama (CVE-2026-0330).
references:
  - https://security.paloaltonetworks.com/CVE-2026-0330
  - https://cwe.mitre.org/data/definitions/94.html
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059
  - attack.privilege-escalation
  - attack.t1068
  - cve.2026.0330
logsource:
  product: paloalto
  service: config
detection:
  selection_cmd:
    cmd:
      - set
      - edit
      - add
  selection_payload:
    after_change_detail|contains:
      - '$('
      - '`'
      - '/dev/tcp/'
      - '; sh'
      - '; bash'
      - '; curl'
      - '; wget'
      - '| sh'
      - '| bash'
      - '&& curl'
      - '&& wget'
  condition: selection_cmd and selection_payload
falsepositives:
  - Administrators storing legitimate scripts, regexes or custom URL patterns in config fields
level: high
```

**Known false positives:**

- Administrators saving legitimate scripts, regexes or URL patterns in config fields
- Automation or IaC tooling that pushes templated config containing shell-like characters

**Tuning notes:** Confirm Panorama forwards config logs to the pan_logs index (adjust index/sourcetype to your environment). Exclude known automation admin accounts and trim the regex to metacharacters that never occur in your legitimate config values. Pair with the Threat ID 510045/510048 detection; the vendor reports no known exploitation, so treat hits as hunt leads.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-0330 Threat Prevention Signature 510045/510048 Hit — Exploitation (locked: unlock with TL Creds)
- Panorama Log Forwarding or Syslog Configuration Tampering — Post-Exploitation (locked: unlock with TL Creds)
- Sentinel Hunt: Panorama-Related CVE-2026-0322 Exploitation Infrastructure — C2/Access (locked: unlock with TL Creds)
- Panorama Admin Login From Public IP Address — Exploitation Precondition (locked: unlock with TL Creds)
- Panorama Configuration Export — Post-Exploitation Collection (locked: unlock with TL Creds)
- Firewall Traffic Involving CVE-2026-0322-Linked IPs Against PAN-OS — C2/Access (locked: unlock with TL Creds)
- Panorama Administrator, Role or Authentication Profile Modification — Post-Exploitation (locked: unlock with TL Creds)
- Panorama-Related Infrastructure From CVE-2026-0322 Exploitation Attempts — C2/Access (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 12)

Defanged, TLP:CLEAR.

- IP address: `66.42.72[.]14`
- IP address: `208.83.239[.]114`
- IP address: `149.248.47[.]234`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Palo Alto Networks Security Advisory CVE-2026-0330: PAN-OS Authenticated RCE in Panorama](https://security.paloaltonetworks.com/CVE-2026-0330)
- [NVD - CVE-2026-0330](https://nvd.nist.gov/vuln/detail/CVE-2026-0330)
- [Palo Alto PAN-OS RCE Flaw Allows Attackers to Execute Arbitrary Code With Root Privileges (Cyber Security News)](https://cybersecuritynews.com/palo-alto-networks-pan-os-rce-vulnerability/)
- [Cyber Security News - PAN-OS vulnerability CVE-2026-0322 (related, separate issue; exploited)](https://cybersecuritynews.com/pan-os-0-day-vulnerability/)
- [CWE-94: Improper Control of Generation of Code ('Code Injection')](https://cwe.mitre.org/data/definitions/94.html)
- [CAPEC-242: Code Injection](https://capec.mitre.org/data/definitions/242.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5840