Threat video1:00
CVE-2026-0330 PAN-OS Panorama RCE: Detection & IOCs
Authenticated admins can run code as root on PAN-OS Panorama via CVE-2026-0330. Patch status, 12 IOCs and 9 detection rules, plus a free Splunk SPL query.
Read the full threat intel for CVE-2026-0330 PAN-OS Panorama RCE: Detection & IOCs →
Chapters
- 0:00The hookPanorama admins can execute code as root.
- 0:05The storyPalo Alto Networks shipped fixes.
- 0:12Attack pathA reported flaw needs admin access.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise8 indicators to hunt: 3 IPs and 5 package names.
- 0:37MITRE ATT&CK techniques3 ATT&CK techniques, from initial access to execution.
- 0:42Remediation3 steps now: Upgrade Panorama to a fixed release for your branch.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Panorama admins can execute code as root.
0:05Palo Alto Networks shipped fixes.
0:07Vendor is unaware of malicious exploitation.
0:12A reported flaw needs admin access.
0:14Internet exposure raises the risk.
0:17Code injection then runs as root.
0:19Fixed releases exist. Upgrade Panorama now.
0:26No threat actor is attributed. Confidence: low.
0:318 indicators to hunt: 3 IPs and 5 package names.
0:373 ATT&CK techniques, from initial access to execution.
0:423 steps now: Upgrade Panorama to a fixed release for your branch.
0:509 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.