PAN-OS CVE-2026-0310

Network access to the PAN-OS management web interface or the dataplane interface is required - these are the two explicitly documented attack surfaces. No authentication is required (PR:N) and no user interaction is needed. The primary factor limiting real-world exposure is network accessibility of the management interface: Palo Alto explicitly states that risk is minimized when this interface is restricted to trusted internal IP addresses per their best practice deployment guidelines, meaning organizations that have applied this restriction face substantially reduced exposure even before patching. The target hardware platform determines impact severity: PA-Series firewalls are susceptible to root RCE, while VM-Series firewalls are susceptible to DoS. Panorama management appliances are also affected. There is no indication that non-default feature enablement or special configuration is required beyond the management or dataplane interface being network-reachable.

The CVSS 4.0 base score of 7.2 with vector AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H reflects genuinely high impact offset by elevated attack complexity - the vendor's AC:H assessment is consistent with an XML-based overflow requiring precise payload construction to reliably trigger the out-of-bounds write. The E:U supplemental metric and U:Red urgency designation signal no confirmed exploitation but vendor concern warranting prompt response. KEV status is not present in the provided intelligence, and no public POC has been identified at time of analysis; EPSS data was not provided. Despite the AC:H modifier, even a mid-sized municipal IT team in ustka managing PA-Series perimeter appliances should treat this as urgent: unauthenticated, network-reachable buffer overflows achieving root execution on firewall appliances are precisely the class of vulnerability threat actors invest in weaponizing. The most significant real-world risk moderator is whether the management interface is restricted to trusted IP ranges per Palo Alto's published best practice guidance - organizations that have followed this guidance retain meaningful exposure reduction even before patching.

An unauthenticated attacker with network access to an exposed PAN-OS management web or dataplane interface sends a crafted HTTP request containing malformed XML that triggers an out-of-bounds write in the parser. On a PA-Series hardware firewall, successful exploitation yields root-level code execution, enabling the attacker to exfiltrate decrypted traffic, install persistent implants, or pivot into managed network segments. On a VM-Series firewall, the most reliable outcome is a process crash causing a firewall outage and dropping network protections until the service recovers.