PAN-OS XML Processing Buffer Overflow Leading to Root RCE

CVE-2026-0310 is a heap-based buffer overflow (CWE-787) in the XML processing subsystem of Palo Alto Networks PAN-OS. An unauthenticated attacker with network access to either the management web interface or the dataplane interface can send a crafted XML payload that triggers an out-of-bounds write. On PA-Series hardware firewalls, this yields arbitrary code execution as root. On VM-Series, the impact is limited to denial of service (crash). Affected versions span PAN-OS 10.2 through 12.2, plus Cloud NGFW (AWS and Azure) and Prisma Access — essentially the entire active PAN-OS fleet. Fixed versions include PAN-OS 12.2.3, 12.1.10, 11.2.13-h2, and various hotfix branches for 11.1 and 10.2.

Palo Alto published differentiated CVSS 4.0 scores: 9.2 base for PA-Series, 8.7 for VM-Series, and 7.5–7.7 for cloud-managed variants. This tiering is intellectually honest — hardware firewalls run flat Linux with root meaning total device ownership, while cloud variants have hypervisor containment. However, the vendor's threat-adjusted score (CVSS-BT 7.2 for PA-Series) leans too optimistic for a perimeter device reachable via the dataplane — the interface that *must* face the network by design. History shows PAN-OS XML/auth bugs (CVE-2024-0012, CVE-2024-3400, CVE-2026-0300) get weaponized within days to weeks of disclosure. The vendor's base score is fair; their threat-adjusted downgrade is premature given the target's value.

Why this verdict

• Canonical high-value role floor: PAN-OS runs exclusively on network edge appliances — firewalls, VPN gateways, and security enforcement points. 100% of PA-Series installs are perimeter infrastructure by definition. Root compromise of this component = network boundary ownership, traffic interception, credential harvesting, and lateral movement pivot. This floors the verdict at CRITICAL.
• Role multiplier: On PA-Series hardware, the chain succeeds at the perimeter high-value role with blast radius of *fleet-scale* — a compromised firewall can modify ACLs to expose the entire internal network, intercept all transit traffic, harvest VPN/SSO credentials, and serve as a persistent C2 relay. On VM-Series the blast radius is limited to DoS (host-level). On Cloud NGFW, blast radius is tenant-level DoS. The worst plausible outcome (PA-Series root RCE at the perimeter) drives the floor.
• Unauthenticated + dataplane reachable: The attack requires no credentials and can target the dataplane interface — the one interface that *cannot* be restricted away because it must face the network to function. This eliminates the most common compensating control (restrict management access) as a complete mitigation.
• Attack complexity friction (AC:H): CVSS rates complexity as High, meaning heap layout dependencies, possible ASLR bypass, and version-specific offsets. No public PoC exists. This is genuine friction that prevents script-kiddie-level exploitation but does NOT stop state-sponsored or well-resourced adversaries who can lab the target hardware.
• Historical precedent: PAN-OS CVE-2024-3400 (command injection) was weaponized as a 0-day. CVE-2026-0300 (similar XML buffer overflow) was exploited pre-disclosure by state-sponsored actors. The pattern strongly suggests CVE-2026-0310 will attract rapid exploit development from APT-tier adversaries.

Why not higher?

The score is 9.0 rather than 10.0 because attack complexity is genuinely High — the exploit must defeat ASLR or similar protections on PAN-OS, requires version-specific heap layout knowledge, and no public PoC or exploitation evidence exists yet. VM-Series deployments (a meaningful fraction of the install base) are limited to DoS, not RCE. These factors cap the score below maximum.

Why not lower?

Downgrading below CRITICAL is not defensible because the affected component is the perimeter by definition — there is no 'restrict network exposure' mitigation that removes the dataplane attack surface. Every PA-Series firewall offering GlobalProtect VPN or Captive Portal presents the vulnerable XML parser to untrusted traffic. The historical pattern of rapid PAN-OS weaponization (CVE-2024-3400 in <48 hours, CVE-2026-0300 pre-disclosure) means the current absence of a public PoC is a temporary condition, not a structural mitigation.

1. Restrict management interface to OOB / jump-host only — Immediately verify that PAN-OS management web UI (TCP/443 on mgmt interface) is not internet-facing. This blocks the management-interface attack vector but does not mitigate the dataplane vector. Deploy within the noisgate mitigation SLA of 3 days for CRITICAL findings.
2. Enable Threat Prevention content updates on dataplane — Ensure Threat Prevention subscription is active and set to auto-update. Palo Alto will likely release an App-ID / Threat signature to detect malformed XML exploitation attempts on dataplane services. Check for content updates daily until a signature is confirmed.
3. Deploy IDS/IPS signatures upstream of the firewall — If you have an inline IPS or cloud-based WAF upstream (e.g., Cloudflare, AWS Shield Advanced, or a dedicated IPS appliance), deploy custom signatures matching oversized or malformed XML POST bodies targeting PAN-OS endpoints. This provides defense-in-depth for the dataplane vector.
4. Enable HA failover and crash monitoring — Ensure HA pairs are configured so that a crash (VM-Series DoS scenario) triggers automatic failover. Configure SNMP traps and syslog alerts for unexpected process restarts on all PAN-OS devices. Forward logs to external SIEM before they can be tampered with.
5. Audit GlobalProtect portal and Captive Portal exposure — Enumerate which firewalls expose GlobalProtect or Captive Portal to the internet. For any that do, prioritize those devices for immediate patching as they present the dataplane XML parser to untrusted traffic.
6. Patch to fixed PAN-OS version — Apply the vendor patch (12.2.3, 12.1.10, 11.2.13-h2, or appropriate hotfix for your branch). This is the only complete remediation. Target completion within the noisgate remediation SLA of 90 days, but given the target profile, push for completion within 2–3 weeks.

Run this script on any auditor workstation with SSH access to your PAN-OS devices. Invoke as: bash check_cve_2026_0310.sh <firewall-ip> <admin-username>. Requires SSH key or password authentication to the PAN-OS CLI. The script checks the running PAN-OS version against known-fixed versions.

#!/usr/bin/env bash
# check_cve_2026_0310.sh — Check PAN-OS version for CVE-2026-0310
# Usage: bash check_cve_2026_0310.sh <firewall-ip> <admin-user>
# Requires: SSH access to PAN-OS CLI
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 2 ]; then
  echo "Usage: $0 <firewall-ip> <admin-user>"
  exit 2
fi

FW_IP="$1"
FW_USER="$2"

# Grab PAN-OS version via CLI
VERSION=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${FW_USER}@${FW_IP}" 'show system info' 2>/dev/null | grep 'sw-version:' | awk '{print $2}' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not retrieve PAN-OS version from ${FW_IP}"
  exit 2
fi

echo "Detected PAN-OS version: ${VERSION}"

# Version comparison helper
version_gte() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

# Check against fixed versions per major branch
case "$VERSION" in
  12.2*)
    if version_gte "$VERSION" "12.2.3"; then
      echo "PATCHED — ${VERSION} >= 12.2.3"
      exit 0
    else
      echo "VULNERABLE — ${VERSION} < 12.2.3 (CVE-2026-0310)"
      exit 1
    fi
    ;;
  12.1*)
    if version_gte "$VERSION" "12.1.10"; then
      echo "PATCHED — ${VERSION} >= 12.1.10"
      exit 0
    else
      echo "VULNERABLE — ${VERSION} < 12.1.10 (CVE-2026-0310). Check if hotfix 12.1.7-h5 or 12.1.4-h10 applies."
      exit 1
    fi
    ;;
  11.2*)
    if version_gte "$VERSION" "11.2.13-h2"; then
      echo "PATCHED — ${VERSION} >= 11.2.13-h2"
      exit 0
    else
      echo "VULNERABLE — ${VERSION} < 11.2.13-h2 (CVE-2026-0310). Check hotfix branches 11.2.10-h14 or 11.2.7-h20."
      exit 1
    fi
    ;;
  11.1*)
    echo "VULNERABLE — PAN-OS 11.1.x requires specific hotfixes for CVE-2026-0310. Consult advisory SVD-2026-0310."
    exit 1
    ;;
  10.2*)
    echo "VULNERABLE — PAN-OS 10.2.x requires specific hotfixes for CVE-2026-0310. Consult advisory SVD-2026-0310."
    exit 1
    ;;
  *)
    echo "UNKNOWN — PAN-OS ${VERSION} not in affected range (10.2–12.2) or unrecognized version format."
    exit 2
    ;;
esac

Sources

1. Palo Alto Networks Security Advisory (CVE-2026-0310)
2. SecurityOnline — PAN-OS Buffer Overflow Flaw Analysis
3. VulnCheck — Routinely Targeted Vulnerabilities 2026
4. Censys Advisory — PAN-OS CVE-2026-0300 (comparable vuln)
5. Splunk Vulnerability Disclosure SVD-2026-0310
6. CISA Known Exploited Vulnerabilities Catalog
7. The Hacker News — PAN-OS RCE Exploit Coverage