CVE-2026-0272: Palo Alto PAN-OS Privilege Escalation Vulnerability (PA-Series, VM-Series, Panorama)

Technical summary

This privilege escalation vulnerability exists in PAN-OS running on PA-Series, VM-Series firewalls, and Panorama appliances (both virtual and M-Series models). The flaw relates to insufficient access controls (CWE-862, CWE-863) and allows an authenticated administrator with CLI privileges to execute operations with root-level permissions without additional authorization checks. Cloud NGFW and Prisma Access deployments are unaffected. The CVSS 3.1 score of 7.2 (HIGH) reflects high impact potential across confidentiality, integrity, and availability, but assumes the attacker already holds administrator credentials and network access to the management interface.

Business impact

A compromised or malicious administrator could leverage this vulnerability to completely override firewall policy, exfiltrate sensitive data, disable security controls, or sabotage network operations. For organizations where PAN-OS devices are core security infrastructure, this represents a direct path to undermining the entire network perimeter defense. Remediation must be prioritized relative to your access control maturity: environments with strict CLI access hygiene and air-gapped management networks face lower practical risk than those with loose administrative access.

Affected systems

CVE-2026-0272 affects Palo Alto Networks PAN-OS deployed on PA-Series and VM-Series firewalls as well as Panorama (both virtual and M-Series hardware versions). Customers running Cloud NGFW or Prisma Access services are not vulnerable. Verify your inventory to identify which platform versions require patching; the vendor advisory will specify the affected PAN-OS versions and corresponding fixes.

Exploitability

Exploitation requires an attacker to already possess valid administrator credentials and network access to the device's management interface—a moderately high barrier in mature security environments but a real risk in organizations with permissive admin access or where admin accounts have been compromised. No network-based unauthenticated attack path exists. The vulnerability becomes practically lower-risk when CLI access is restricted to a handful of trusted administrators and management access is limited to internal IP addresses, as recommended in Palo Alto's security guidelines.

Remediation

Immediately apply the security patches released by Palo Alto Networks. Consult the vendor advisory to identify the affected PAN-OS versions and corresponding fixed versions for your platform (PA-Series, VM-Series, or Panorama). In parallel, enforce least-privilege access by restricting CLI access to only administrators who require it, and implement IP-based access controls limiting management interface connectivity to trusted internal subnets. Review admin account activity logs for any suspicious CLI commands executed with elevated privileges.

Patch guidance

Obtain and review the official Palo Alto Networks security advisory for CVE-2026-0272 to determine the precise fixed PAN-OS versions for your platform type. Plan patching during a maintenance window; PAN-OS upgrades typically require careful sequencing in environments with redundant firewalls or Panorama-managed device clusters. Test patches in a staging environment first. After patching, verify that admin access controls and logging are functioning correctly.

Detection guidance

Monitor CLI audit logs for admin accounts executing root-level commands or accessing restricted system functions. Correlate CLI activity with change tickets and approved maintenance windows to identify unauthorized escalations. Enable verbose logging on the management interface to track successful and failed authentication attempts. Review firewall policy changes tied to admin CLI activity, especially modifications to security rules or administrator account permissions. Consider implementing a SIEM integration to alert on suspicious privilege usage patterns.

Why prioritize this

Although this vulnerability requires pre-existing administrator access, the potential impact—complete firewall compromise—is severe and could facilitate advanced persistent threats or regulatory violations. Organizations with restrictive CLI access policies and robust admin access controls can operate at moderate risk while awaiting patches. However, those with permissive administrative environments should treat patching as urgent. The absence of the vulnerability from the KEV catalog does not reduce its importance for environment-specific risk assessment.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects the high impact on confidentiality, integrity, and availability if an attacker with admin credentials gains root access. The score assumes an authenticated attacker with high privileges (PR:H) and network connectivity to the management interface (AV:N). The practical risk in your environment depends heavily on your implementation of the vendor's recommended access controls: strict CLI access limits and management interface IP whitelisting substantially reduce exploitability.

Frequently asked questions