AI analysis
Claude Opus · 6 Nov 2026, 10:20 CET
Exploited PAN-OS management interface flaw lets admins run code as root
An actively exploited code injection flaw in the PAN-OS management interface lets an authenticated attacker run code as root on Palo Alto Networks firewalls and Panorama. Restrict management access to trusted internal addresses now and apply vendor fixes.
In plain terms
PAN-OS is the operating system that runs Palo Alto Networks firewalls (PA-Series and VM-Series) and the Panorama central management platform. A flaw in the management interface, the web and administrative portal used to configure the device, allows someone who can log in to it to run their own code on the device with root privileges. Root is the highest level of control, so the attacker effectively owns the firewall.
The attacker needs valid administrative credentials and network access to the management interface, which limits who can abuse it. However, CISA has confirmed that the flaw is being exploited in real attacks. Any organisation running affected PAN-OS versions should care, especially if the management interface is reachable from the internet or from broad internal networks. Cloud NGFW and Prisma Access are not affected.