PAN-OS: authenticated management-interface RCE gives root on the firewall or Panorama

Impact

An attacker who can authenticate to the PAN-OS management interface with high privilege executes arbitrary code as root on the firewall or Panorama appliance. For a datacenter that fronts its fleet with PAN-OS, that is full control of the device that enforces north-south segmentation, plus whatever credentials and configuration the appliance holds - and Panorama compromise extends to every firewall it manages. CISA lists this CVE as known exploited, and the vendor marks exploitation as attested in the CVSS vector. There is no tenant-facing path: the dataplane is not the exposure, the management plane is.

Who can reach it

Network access to the PAN-OS management interface with valid high-privilege administrative credentials. Cloud NGFW and Prisma Access are not affected. Exposure collapses if the management interface is reachable only from trusted internal management addresses, which is the vendor's documented deployment practice.

What to do

Install the fixed PAN-OS maintenance release from the vendor advisory for each PA-Series, VM-Series and Panorama instance; the advisory, not this record, carries the per-branch fixed versions. A PAN-OS upgrade reboots the appliance, so plan it against your HA pair failover - upgrade the passive member, fail over, then the other. Interim mitigation: restrict the management interface to trusted internal IPs and a dedicated management VLAN, and rotate administrator credentials given active exploitation.

References

Related entries

• Arista CloudVision Portal: authenticated path traversal in image repositories reads and writes arbitrary platform filesCVE-2026-101154 · Arista CloudVision Portal (Network Provisioning image repository and Software Management Studio repository)High
• Junos eventd: heap overflow in IPC event messages gives a local unprivileged user root on the deviceCVE-2026-101927 · Juniper Junos OS / Junos OS Evolved eventd (IPC event message handling)High
• Eaton Tripp Lite series PADM firmware (rack PDU / ATS management): Unauthenticated authentication bypass givesCVE-2026-22620 · Eaton Tripp Lite series PADM firmware (rack PDU / ATS management)High
• Arista EOS: crafted gNSI Credentialz request can grant an account privileges beyond what was configuredCVE-2026-73454 · Arista EOS gNSI Credentialz serviceHigh
• Cisco NX-OS: unvalidated command input lets an unauthenticated attacker deny service beyond the deviceCVE-2026-76456 · Cisco NX-OS Software (input validation of special elements in a command, also ACI mode and UCS Managed)High
• Cisco NX-OS: out-of-bounds read lets an unauthenticated attacker crash the switchCVE-2026-76457 · Cisco NX-OS Software (out-of-bounds read, also ACI mode and UCS Managed)High