15 SEP 2026 — Palo Alto Networks has disclosed a flaw that lets an unauthenticated attacker run code as root on its PA-Series hardware firewalls by sending malformed XML. The advisory, published on 9 September, rates it 9.2 under CVSS version 4, gives it the company's highest remediation urgency, and lists no workaround. As of publication, Palo Alto knew of no exploitation.
Two details set it apart from the PAN-OS advisories that have preceded it this year. It can be reached through a dataplane interface, not only the management interface. And there is nothing to do about it except patch.
What the flaw does
CVE-2026-0310 is a buffer overflow in PAN-OS's XML processing, classified as an out-of-bounds write. An attacker with network access to an affected management web interface or dataplane interface can send crafted input that overflows the buffer.
The consequence depends on the platform. On PA-Series hardware it is arbitrary code execution with root privileges. On VM-Series virtual firewalls the impact is limited to denial of service. Prisma Access and Cloud NGFW are affected but require authentication, which lowers their exposure considerably. Panorama, the central management platform, is also listed as impacted.
Panorama raises the stakes. It is the system that pushes configuration and policy to fleets of firewalls, so a compromise there is not one device lost but a position from which every managed device can be reconfigured. Organisations that run Panorama tend to be the larger estates, which are also the ones where a single foothold is worth most to an attacker.
Affected PAN-OS branches run from 10.2 to 12.2. Fixed releases include 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2 and 10.2.18-h10, with further hotfix builds for some branches. The flaw was found internally, credited to Ben Nott.
Why the dataplane matters
The standard advice for PAN-OS flaws is to keep the management interface off the internet and reachable only from trusted internal addresses. It is good advice, and for most of this year's PAN-OS advisories it has turned a critical bug into a contained one.
Palo Alto repeats that advice here, and it still reduces risk. But a dataplane interface is the part of the firewall that carries traffic, which means it exists precisely to receive packets from networks the organisation does not control. Restricting the management plane does not remove a path that runs through the dataplane. The advisory text we have does not say which dataplane features expose the XML processing, so no deployment should be assumed safe on that basis.
Reading the two scores
The advisory gives two numbers for PA-Series: a base score of 9.2 and a threat-adjusted score of 7.2. Both figures describe the same flaw. CVSS version 4 separates the intrinsic severity of a bug from what is currently known about attacks on it, and the lower number reflects that exploit maturity is unreported.
That second number is the one most likely to move. In version 4 the threat group carries a single metric, exploit maturity, and it defaults to assuming the worst when nothing is known. Palo Alto has set it to unreported, which pulls the score down. If a proof of concept appears or exploitation is observed, that metric changes and the score climbs back towards the base.
Many organisations schedule patches by score band. A 7.2 can land in a slower queue than a 9.2, and on this flaw the 7.2 is a statement about the present state of attacker knowledge rather than about the damage the bug can do. The base score is the one to plan against.
Why "not yet exploited" is a short window
PAN-OS has already had two actively exploited flaws this year: CVE-2026-0300, a zero-day attributed to state-sponsored operators in May, and CVE-2026-0257 in GlobalProtect, exploited within weeks of disclosure. Perimeter firewalls are high-value targets, they are findable by scanning, and a published fix gives researchers and attackers a map to the vulnerable code. The pattern across edge appliances in 2026 has been that the gap between patch and working exploit is measured in days, not months.
That makes this advisory the rarer case. A critical perimeter flaw has been disclosed with no exploitation on record, and defenders have a head start they do not usually get.
What to do
Patch PA-Series hardware first, because that is where the flaw yields root. Then Panorama, then VM-Series, where the worst case is an outage rather than a compromise.
Start with inventory. Many organisations run a mix of hardware and virtual firewalls across sites and clouds, and the difference between root code execution and a crash depends on which is which. Knowing where each PA-Series box sits, and which of its interfaces face untrusted networks, decides the patching order.
Check the advisory against the exact build each device runs, not just its major branch. Palo Alto's fixes arrive as specific hotfix releases within each branch, and a firewall one hotfix behind the listed version is still exposed. Where firewalls run as high-availability pairs, they can usually be upgraded one member at a time, which keeps traffic flowing and removes the most common reason for postponing a perimeter patch.
Keep management interfaces restricted to trusted internal addresses regardless — it narrows the exposure while patching proceeds. Do not treat that restriction as a substitute for the update, because the dataplane path remains.
And watch the exploitation status. Palo Alto updates its advisories when that changes, and a move from unreported to observed is the signal that the lower score no longer applies.
View author profile → · Editorial policy
