A code injection flaw (CWE‑94) in the management interface of PAN‑OS allows an authenticated attacker with network reachability to execute arbitrary code with root privileges, potentially compromising the entire firewall or Panorama appliance.

The vulnerability applies to PAN‑OS software on PA‑Series and VM‑Series firewalls, as well as to virtual and M‑Series Panorama appliances; Cloud NGFW and Prisma Access are not affected.

The CVSS score of 8.5 indicates a high severity vulnerability, and the issue is listed in the CISA KEV catalogue, implying known exploitation activity. Because the attack vector requires valid credentials and network access to the management interface, the threat primarily comes from insiders or attackers who have compromised legitimate user accounts. The absence of an EPSS score does not negate the high risk; the documented exploitation potential combined with root‑level impact makes mitigation urgent.