EUVD-2026-42675
GHSA-fhqp-fjgf-qf28
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Administrator-only CLI access drives PR:H and AV:N; arbitrary root execution independently warrants A:H despite vendor's conservative VA:N choice.
Primary rating from Vendor (paloaltonetworks).
CVSS VectorVendor: paloaltonetworks
Lifecycle Timeline
3DescriptionCVE.org
A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root.
The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
AnalysisAI
Command injection in the Palo Alto Networks PAN-OS management plane allows an authenticated administrator to execute arbitrary OS commands with root privileges on PA-Series, VM-Series, and Panorama appliances. The vulnerability is classified CWE-78 and is reachable via the network-accessible management interface, though the requirement for administrator-level credentials substantially constrains the attacker pool. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
Technical ContextAI
PAN-OS is Palo Alto Networks' operating system underpinning PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama management appliances (both virtual and M-Series hardware). The management plane - the administrative control layer handling configuration, logging, and device orchestration - contains an OS command injection flaw classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). This root cause class arises when user-supplied input is passed unsanitized to a system shell interpreter, allowing shell metacharacters to break intended command boundaries. In this instance, an administrator-level user can inject OS commands that execute with root privileges, bypassing the privilege boundary between the management plane user context and the underlying OS. The explicit exclusion of Cloud NGFW and Prisma Access confirms the flaw is isolated to the on-premises PAN-OS software stack and not present in the hosted service control planes.
RemediationAI
The primary remediation is to apply the vendor-released patch per the Palo Alto Networks advisory at https://security.paloaltonetworks.com/CVE-2026-0286 - exact fix versions are not present in the current data and must be confirmed from that advisory before deployment. As a compensating control while patching, restrict CLI access to the smallest possible group of administrators; the vendor explicitly confirms this significantly reduces security risk. Enforce network-level access controls on the management interface by isolating it to a dedicated out-of-band management network or VPN-restricted jump host accessible only from trusted administrator workstations, reducing the network exposure of the vulnerable surface. Enforce multi-factor authentication on all PAN-OS administrator accounts to raise the credential-theft bar an attacker must clear before reaching the injection point. Audit and minimize the number of accounts with full administrator privileges, replacing with lower-privilege operator roles where full CLI access is not operationally required.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today