An authenticated attacker who can reach the PAN-OS management interface can inject code that runs as root on PA-Series, VM-Series, or Panorama firewalls, and the flaw is already being exploited.