PAN-OS CVE-2026-0272

Exploitation requires an existing authenticated PAN-OS administrator account with CLI access - CVSS PR:H explicitly confirms high privilege is required, and the description limits scope to administrators with CLI access specifically. The management CLI must be reachable to the attacker, either via SSH to the management interface or via direct console connection. Palo Alto explicitly states that restricting CLI access to a limited group of administrators and limiting management interface network access to trusted internal IP addresses significantly reduces risk. Cloud NGFW and Prisma Access deployments are NOT vulnerable regardless of configuration. Non-administrator accounts, read-only operator roles, and web UI-only administrators without CLI access cannot exploit this vulnerability. The vulnerability does not apply to the data plane - only to administrative management interfaces.

The CVSS 4.0 score of 6.0 with PR:H accurately reflects that exploitation is gated behind existing administrative authentication, sharply limiting the realistic attacker pool to insiders, compromised-credential scenarios, or supply chain threats. The supplemental metric E:U (unexploited) and absence from CISA KEV both confirm no known active exploitation at time of analysis, and no POC code is identified in available intelligence. EPSS data is not present in the source intelligence and cannot be assessed. Despite the moderate composite score, the VC:H and VI:H impact metrics reflect the true severity consequence: root access to a next-generation firewall OS enables exfiltration of VPN private keys, captured traffic, stored credentials, and installation of persistent backdoors outside PAN-OS visibility. The key distinguishing factor for prioritization is whether your deployment restricts CLI access and management interface access to trusted IPs - organizations that follow Palo Alto's hardening guidance face materially lower risk than those with broadly accessible management interfaces. This is a real priority for environments with permissive admin access policies, but a lower priority where CLI access is tightly controlled.

A malicious insider or an attacker who has separately compromised a PAN-OS administrator account authenticates to the management CLI via SSH and executes crafted commands that trigger the missing authorization check, obtaining a root shell on the underlying operating system. With root access, the attacker can exfiltrate VPN private keys, decrypt captured traffic, harvest stored credentials, or install kernel-level persistence mechanisms invisible to PAN-OS configuration audits. No public proof-of-concept has been identified at time of analysis, so successful exploitation likely requires internal familiarity with the specific CLI commands or code paths that expose the missing authorization flaw.