CVE-2026-0310 means that, in 2026, the product parses XML from the network as root, and and suffers from the most straightforwardly fixable class of memory unsafety. Depending on the details, they also might not be using exploit mitigations.
That's just a long way of saying "Decommission your deployments of products from this vendor."
RE: https://infosec.exchange/@cR0w/117236916712662443
lol. lmao even.
https://security.paloaltonetworks.com/CVE-2026-0310
https://security.paloaltonetworks.com/CVE-2026-0307
note1qy9…vlwf