PAN-OS CVE-2026-0331 and Panorama RCE: November 2026 Hotfixes

Published 12 November 2026 · Rathish Kumar, Invitty

Palo Alto Networks published seven PAN-OS advisories on 11 November 2026. The one that matters for most PA-Series and VM-Series firewalls is CVE-2026-0331. An attacker with no login can obtain sensitive firewall and session data by aiming traffic at, or through, any of the firewall's dataplane interfaces, and no special configuration is needed. None of the seven is known to be exploited. Install the hotfix for your release train, for example 11.1.16-h5 or 11.2.16-h2.

Why CVE-2026-0331 goes first

On paper this is a medium-severity bug, with a CVSS 4.0 threat score of 6.6. Look at the conditions instead of the score. It works over the network, with low complexity, no credentials and no user interaction, and the advisory says no particular feature has to be switched on. Palo Alto Networks lists no workaround, so patching is the only fix. It names PA-Series and VM-Series firewalls as carrying the highest risk. Panorama is not affected by this one.

The advisory does not say exactly what the leaked data contains beyond firewall and session information. In our view that is enough. Session tables show who talks to what inside your network, and that is the map an intruder wants before trying anything else. The credit line names OpenAI alongside an internal Palo Alto researcher, which fits the pattern we saw from Fortinet this week: vendors are using AI tooling to find bugs faster, and patch cycles are getting denser as a result.

The rest of the batch, and the conditions that make each one bite

Most of the remaining advisories only apply if a particular feature is in use. That is what decides your real exposure.

Two more items came out the same day: CVE-2026-0324, a privilege management flaw in the GlobalProtect app on Windows tied to the OPSWAT MetaDefender SDK it bundles, and a monthly Chromium roll-up. If you push GlobalProtect to Windows laptops, look at the app advisory as well.

Which hotfix to install on each train

The fixed builds are the same across the PAN-OS advisories, with one catch. For CVE-2026-0331, 0330, 0329 and 0328, every maintenance release on a train got its own hotfix, so a firewall on 11.1.10 can go to 11.1.10-h37. For CVE-2026-0327, the RADIUS challenge issue, the advisory lists only the newest hotfix on 12.1, 11.2 and 11.1. If your GlobalProtect logins use RADIUS with a challenge, for example an OTP prompt, the older hotfixes do not cover you.

The advisory for CVE-2026-0327 does not list 10.2 at all. Anything older than 10.2 is unsupported, and Palo Alto Networks' instruction is simply to move to a supported fixed version. If a firewall in your estate is still on 9.1 or 10.1, it has missed far more than this batch.

What to do this week, in order

1. Record the current PAN-OS version of every firewall and Panorama from the dashboard or show system info, and note whether GlobalProtect uses RADIUS challenges or third-party clients.
2. Pick the hotfix from the table above. When in doubt, choose the newest one on your train so CVE-2026-0327 is covered too.
3. Upgrade Panorama first, then passive HA members, then active ones, so the managing system is never older than what it manages.
4. If the window is days away, apply the stopgaps Palo Alto lists. For CVE-2026-0327, switch the gateway's client authentication to SAML or another profile without a challenge, or require a client certificate. For CVE-2026-0329, disable CRL and OCSP checks on the IKE certificate profile or turn off DNS Proxy if you can live without them. For CVE-2026-0330, restrict Panorama management to trusted internal addresses or a single jump host.

For CVE-2026-0330 and 0329 the advisories also mention Threat IDs that give limited coverage. They need Applications and Threats content 9171-10349 or later and SSL decryption, and the Panorama advisory ties them to a Threat Prevention subscription. CVE-2026-0331 has no stopgap at all.

What this means for renewals and refresh plans in India

Hotfix downloads come from the Palo Alto support portal, so the device needs active support. Those Threat ID mitigations depend on a live Threat Prevention subscription as well. When we audit an estate after a batch like this, the most common gap is a firewall whose security subscriptions renewed but whose support did not, or the other way round. Check both end dates side by side, and if they are out of step, our renewals team can co-term them on one GST invoice.

If a firewall in your estate cannot run any supported train, stop paying to keep it alive and price a replacement while you are already planning a window. Our Palo Alto firewall page lists what we supply, and the migration page covers moving policies across without a long outage.

Questions we are hearing about the November PAN-OS batch

Next step

Send us the model, serial number and PAN-OS version of each firewall and Panorama, and tell us how GlobalProtect users authenticate. We will reply with the exact hotfix for each device, any stopgaps worth applying before your window, and the support and subscription end dates we can see. See our Palo Alto Networks page for what else we deploy.

Sources

Facts in this post come from these pages, checked on the date of publication. Vendor advisories change, so check the advisory itself before you schedule work.

• Palo Alto Networks advisory: CVE-2026-0331
• Palo Alto Networks advisory: CVE-2026-0330
• Palo Alto Networks advisory: CVE-2026-0329
• Palo Alto Networks advisory: CVE-2026-0328
• Palo Alto Networks advisory: CVE-2026-0327
• Palo Alto Networks security advisory index