EUVD-2026-30107
GHSA-3jxr-6794-xw26
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber
Primary rating from Vendor (palo_alto) · only source for this CVE.
CVSS VectorVendor: palo_alto
Lifecycle Timeline
5DescriptionCVE.org
Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI.
The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma Access® are not impacted by these vulnerabilities.
AnalysisAI
Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS allow an authenticated administrator to escape system restrictions and execute arbitrary commands with root-level privileges on affected firewalls and Panorama management platforms. Affected deployments include PA-Series and VM-Series firewalls and Panorama (virtual and M-Series appliances) across PAN-OS versions 10.2, 11.1, 11.2, and 12.1. An attacker who already holds administrative credentials and can reach the CLI or Web UI can leverage these flaws to fully compromise the underlying OS. No public exploit code exists and no KEV listing is present at time of analysis, consistent with the very low EPSS score of 0.08% (24th percentile).
Technical ContextAI
CWE-78 (Improper Neutralization of Special Elements used in an OS Command, aka OS Command Injection) describes the root cause: user-controlled input is passed to a system shell without sufficient sanitization, allowing shell metacharacters to inject additional commands. The vulnerability exists in multiple locations within the PAN-OS codebase, accessible through both the PAN-OS command-line interface and the Web UI administrative interface. Affected CPE is cpe:2.3:a:palo_alto_networks:pan-os on PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama management appliances (virtual and M-Series). Although the NVD CPE data lists cpe:2.3:a:palo_alto_networks:cloud_ngfw and cpe:2.3:a:palo_alto_networks:prisma_access, the vendor advisory explicitly states Cloud NGFW and Prisma Access are NOT impacted - this CPE inclusion appears to be a data artifact and should be disregarded. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) confirms the attack is delivered over the network with no additional attack complexity, but only reachable by an already-authenticated high-privilege (administrator) account.
RemediationAI
The primary remediation is to upgrade PAN-OS to one of the vendor-released fixed versions: 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, or 10.2.7-h34 for the 10.2 train; 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, or 11.1.4-h33 for the 11.1 train; 11.2.12, 11.2.10-h6, 11.2.7-h13, or 11.2.4-h17 for the 11.2 train; and 12.1.7 or 12.1.4-h5 for the 12.1 train. See the official advisory at https://security.paloaltonetworks.com/CVE-2026-0261 for the full matrix. Where immediate patching is not possible, apply the vendor's recommended best-practice management access hardening: restrict CLI access to the smallest possible set of named administrators (reducing the number of accounts that could exploit the flaw), and restrict access to the Web UI management interface to trusted internal IP addresses only using management access control lists. Note that these compensating controls reduce but do not eliminate risk - a compromised or malicious administrator account within the allowed IP range retains the ability to exploit this issue until patching is applied. Reducing administrative account sprawl (disabling shared or unused admin accounts) further limits exposure.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today