BREAKING: CVE-2026-0310 PAN-OS XML overflow gives unauth root on PA-Series

An unauthenticated packet to the management web or the dataplane XML path can put a root shell on a PA-Series firewall. Palo Alto Networks published CVE-2026-0310 on September 9, 2026 with Suggested Urgency HIGHEST. The bug is a buffer overflow in PAN-OS XML processing. No special configuration is required. On PA-Series hardware the impact is arbitrary code execution as root. On VM-Series the same path is DoS only. Panorama is in scope. Prisma Access and Cloud NGFW are a lower (authenticated / restricted) severity band and Palo Alto will patch those tenants on the next maintenance cycle.

This is the operator write-up. The HOL Guard evidence pack for CVE-2026-0310 is the source record.

What breaks

Vendor description: an unauthenticated attacker with network access to the management web interface or the dataplane interface can trigger the overflow. That second clause matters. Locking the management port to a jump box is necessary and still not enough if a dataplane interface accepts the same XML processing path from an untrusted network.

Severity is product-split in the advisory, not a single CVSS story:

• PA-Series hardware: HIGH / Urgency HIGHEST. CVSS-B 9.2, CVSS-BT 7.2 (CVSS:4.0, Attack Complexity High, Privileges Required None). Root RCE.
• VM-Series: MEDIUM. DoS only (availability), not code execution.
• Prisma Access and Cloud NGFW: MEDIUM. Requires an authenticated user and external access is already restricted. Palo Alto patches those fleets on the scheduled maintenance window; on-demand upgrade is available through support.

Exploit maturity is UNREPORTED. Palo Alto says it is not aware of malicious exploitation. Automatable is NO. This is not the May Captive Portal bug CVE-2026-0300 (that one was Critical, captive-portal config required, and later confirmed exploited).

Affected PAN-OS trains (from the advisory Product Status / Solution tables): 12.2 before 12.2.3; 12.1 before the listed hotfixes culminating in 12.1.10 / 12.1.7-h5 / 12.1.4-h10; 11.2 before 11.2.13-h2 / 11.2.10-h14 / 11.2.7-h20 / 11.2.4-h21; 11.1 before 11.1.16-h2 / 11.1.13-h12 / 11.1.10-h33 / 11.1.7-h10 / 11.1.6-h38 / 11.1.4-h36; 10.2 before 10.2.18-h10 / 10.2.16-h10 / 10.2.13-h24 / 10.2.10-h40 / 10.2.7-h37. Unsupported older trains: move to a supported fixed version. Prisma Access fixed points are 12.1.7-h5, 11.2.7-h20, 10.2.10-h40.

Same-day siblings (do not confuse urgency)

Palo Alto also shipped three siblings on the same day. They share some PAN-OS upgrade trains with 0310, but they are not the same blast radius:

• CVE-2026-0307 GlobalProtect app local privilege escalation to SYSTEM/root on Windows/macOS/Linux (not iOS/Android/ChromeOS). Fix needs both the GlobalProtect app build and the matching PAN-OS / Prisma Access train. Medium.
• CVE-2026-0308 stored XSS for an already-authenticated administrator in the web UI. Low. Cloud NGFW, Prisma Access, and PAN-OS 12.2 are not affected.
• CVE-2026-0309 authenticated CLI command injection to root, only when Luna HSM is configured. Medium. Check Device > Setup > HSM; if HSM fields are empty you are outside this one. Panorama / Cloud NGFW / Prisma Access not impacted.

Patch 0310 first on any internet-reachable or untrusted-network-facing PA-Series / Panorama. Then triage 0307 clients and 0309 HSM boxes on the same maintenance window if you are already taking the firewall reboot.

Who is not in scope

GlobalProtect mobile (iOS / Android / ChromeOS) for 0307. Prisma Access and Cloud NGFW for the unauthenticated root story of 0310 (they sit in the authenticated / restricted medium band and are vendor-managed). Firewalls already on a listed fixed hotfix. CVE-2026-0309 if Luna HSM is not configured. CVE-2026-0308 if you have no admin sessions that can reach the management UI from hostile browsers. This article is not about CVE-2026-0300 (User-ID Authentication Portal / Captive Portal), which is a different bug class from May 2026.

How to check

On the firewall or Panorama CLI:

show system info | match sw-version
show system info | match model

Compare sw-version to the fixed row for your minor train in the advisory Solution table (for example 11.2.4-h20 is still vulnerable; 11.2.4-h21 is the floor for that branch). Then audit exposure, not just version:

show interface management
show network interface | match management-profile

If any dataplane interface carries a management profile that exposes HTTPS / XML API toward an untrusted zone, treat that path as in scope for 0310 even when the dedicated MGT port is jump-box-only.

How to fix

Upgrade PAN-OS to the fixed hotfix for your minor train. Examples from the advisory: 12.2.3+, 12.1.10 (or 12.1.7-h5 / 12.1.4-h10 on older 12.1 branches), 11.2.13-h2 (or 11.2.10-h14 / 11.2.7-h20 / 11.2.4-h21), 11.1.16-h2 (or the listed 11.1.x-h* floors), 10.2.18-h10 (or the listed 10.2.x-h* floors). Prisma Access and Cloud NGFW customers who cannot wait for the scheduled cycle should open a support / account-team on-demand upgrade. There is no published workaround for 0310. Restricting management to a jump box lowers the CVSS path but does not remove dataplane XML exposure.

What this is not

This is not a confirmed in-the-wild / KEV event as of the September 9 advisory (Exploit Maturity UNREPORTED, Automatable NO, Attack Complexity High on the PA-Series RCE score). It is not Captive Portal CVE-2026-0300. It is not a GlobalProtect-only story (that is 0307). Damage on PA-Series is root code execution from an unauthenticated network packet to management web or dataplane XML.

References

• Palo Alto Networks advisory CVE-2026-0310
• Sibling CVE-2026-0307 (GlobalProtect LPE)
• Sibling CVE-2026-0308 (stored XSS)
• Sibling CVE-2026-0309 (Luna HSM CLI injection)
• HOL Guard pack CVE-2026-0310