PAN-OS CVE-2026-0320

Exploitation requires an authenticated PAN-OS administrator account (PR:H) with network access to the PAN-OS management interface on an affected PA-Series or VM-Series firewall or Panorama (virtual or M-Series) appliance. The attacker abuses administrative input handling to inject OS commands and escape system restrictions to root. Key limiting factors: valid administrator authentication is mandatory, and reachability is confined to the management plane - Palo Alto's recommended best practice of restricting management-interface access to trusted internal IP addresses significantly reduces real-world exposure. Cloud NGFW and Prisma Access deployments are explicitly not affected and are not valid targets.

This is a moderate, not top-tier, priority. The CVSS 4.0 base score of 6.1 is held down primarily by PR:H - exploitation requires an already-authenticated PAN-OS administrator with access to the management interface - which is confirmed by both the description ('authenticated administrator') and the vector. The technical impact is severe once that bar is met (VC:H/VI:H/VA:H, command injection to root, CWE-78), so this is effectively an administrator-to-root privilege/restriction bypass rather than a remote-unauthenticated compromise. Multiple low-risk signals align: the threat metric E:U marks the exploit as Unproven, there is no CISA KEV listing and no POC in the provided data, and no EPSS score was supplied. The vendor (Palo Alto) explicitly notes risk is 'significantly minimized' when the management interface is restricted to trusted internal IPs per best practice, which is the standard deployment posture. Net: a genuine root-execution flaw, but gated behind admin credentials and management-plane access, so it is a patch-in-normal-cycle item for most, elevated only where the management interface is broadly exposed or where lower-trust admin accounts exist. Note one data conflict to verify: the AV:N vector implies network reachability, but exploitation realistically depends on management-interface exposure, which best practice confines to internal trusted IPs - treat 'network' as management-plane network, not Internet-wide.

An attacker who has obtained valid PAN-OS administrator credentials (or an insider/lower-trust admin) reaches the firewall or Panorama management interface and submits a crafted administrative input that injects shell metacharacters, escaping the restricted CLI/management context to execute arbitrary commands as root. No public exploit code is identified at time of analysis, and the CVSS marks the exploit as Unproven. Low attack complexity (AC:L) and no user interaction (UI:N) mean the step is reliable once an admin session and management access are available.