Plan ahead Medium Check your exposure CVSS 6.1 (NVD)
Palo Alto Networks Panorama flaw allows authenticated remote code execution
Palo Alto Networks advisoriesPalo Alto Networks PAN-OS, PanoramaCVE-2026-0330
What happened. Palo Alto Networks published an advisory for CVE-2026-0330, an authenticated remote code execution flaw in Panorama on PAN-OS. The advisory rates it medium severity.
Who is affected. Users of Palo Alto Networks PAN-OS with Panorama. Sites using these firewalls at the boundary of plant networks should check, as engineers and vendors often connect through them.
What to do. Check whether you run Panorama on PAN-OS and read the Palo Alto Networks advisory for CVE-2026-0330 for fixed versions.
When to act. Plan ahead: No exploitation stated; check whether Panorama manages boundary firewalls and schedule the fix.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L4
- L3.5
Why: Panorama manages the boundary firewalls that separate plant networks from enterprise IT, so it sits at the industrial DMZ (L3.5) and enterprise IT (L4).
- Are you exposed?
Search your asset inventory for Panorama instances and the firewalls they manage, and compare their versions with the advisory.
- If you cannot fix it yet
- Restrict access to the Panorama management interface to a small set of administrator hosts.
- Require multi-factor authentication and review which accounts hold Panorama logins.
- Watch for
- Logins to Panorama from unfamiliar hosts or accounts.
- Unexpected configuration changes or new commands pushed from Panorama to managed firewalls.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Palo Alto Networks advisories (opens security.paloaltonetworks.com)