CVE-2026-0330

Adatlap

CVE: CVE-2026-0330
EUVD: EUVD-2026-123779
GHSA: GHSA-x6wp-gjw2-wqqh
Eszköztípus: IT
Publikálva: 2026. 11. 11. 20:37
Frissítve: 2026. 11. 11. 20:37
Súlyosság: Közepes
Prioritás: Fokozott
CWE: CWE-94

CVSS-pontszámok

Verzió	Pontszám	Súlyosság	Vektor
4.0	6,1	Közepes	`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/RE:M/U:Amber`

Hálózatról kihasználható · Alacsony komplexitás · Magas jogosultság szükséges · Nem szükséges felhasználói interakció

Eredeti leírás

A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with network access to execute arbitrary code with root privileges.

The security risk posed by this issue is significantly minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

Cloud NGFW, Prisma® Access, and standalone PAN-OS firewalls are not affected by this vulnerability.

Érintett termékek

Cloud NGFW Palo Alto Networks Verziók: All
PAN-OS Palo Alto Networks Verziók: 12.2.0 – < 12.2.4-h2; 12.1.0 – < 12.1.10-h4; 11.2.0 – < 11.2.16-h2; 11.1.0 – < 11.1.16-h5; 10.2.0 – < 10.2.18-h14
Prisma Access Palo Alto Networks Verziók: All

Prioritás

Szint: Fokozott
Teendő: Azonnali intézkedés nem szükséges, de kövesse figyelemmel a sérülékenységet, mert a megítélése (például a kihasználtsága) változhat. Új információ hiányában a szoftvert a normál frissítési ütemezés szerint frissítse.

Kihasználási státusz

EPSS: 0,00%
Exploitok: Palo Alto Networks is not aware of any malicious exploitation of this issue.

Javítás

Javított verzió: All, 12.2.4-h2, 12.1.10-h4, 12.1.7-h12, 12.1.4-h14, 11.2.16-h2, 11.2.13-h5, 11.2.10-h18, 11.2.7-h24, 11.2.4-h24, 11.1.16-h5, 11.1.13-h17, 11.1.10-h37, 11.1.7-h13, 11.1.6-h41, 11.1.4-h39, 10.2.18-h14, 10.2.16-h13, 10.2.13-h28, 10.2.10-h43

+1 további
10.2.7-h40
Gyártói hivatkozás: Van patch vagy gyártói közlemény a hivatkozások között

Megoldás (CNA)

VERSION MINOR VERSION SUGGESTED SOLUTION
Cloud NGFW No action needed.
PAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h2 or later.
PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h4 or later.
12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h12 or later.
12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h14 or later.
PAN-OS 11.2 11.2.15 through 11.2.16-h* Upgrade to 11.2.16-h2 or later.
11.2.11 through 11.2.13-h* Upgrade to 11.2.13-h5 or 11.2.16-h2 or later.
11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h18 or 11.2.16-h2 or later.
11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h24 or 11.2.16-h2 or later.
11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h24 or 11.2.16-h2 or later.
PAN-OS 11.1 11.1.14 through 11.1.16-h* Upgrade to 11.1.16-h5 or later.
11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h17 or 11.1.16-h5 or later.
11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h37 or 11.1.16-h5 or later.
11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h13 or 11.1.16-h5 or later.
11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h41 or 11.1.16-h5 or later.
11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h39 or 11.1.16-h5 or later.
PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18-h14 or later.
10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h13 or 10.2.18-h14 or later.
10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h28 or 10.2.18-h14 or later.
10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h43 or 10.2.18-h14 or later.
10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h40 or 10.2.18-h14 or later.
All older Upgrade to a supported fixed version.
unsupported
PAN-OS versions
Prisma Access No action needed.

Kerülő megoldás (CNA)

No known workarounds exist for this issue.

Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510045 and 510048 (from Applications and Threats content version 9171-10349 and later). Please note that this Threat ID requires SSL Decryption.