Cortex XSOAR/XSIAM CVE-2026-0313

Requires an authenticated administrator account on Cortex XSOAR or Cortex XSIAM (PR:H) and the OS Query content pack must be in use for querying/managing remote endpoints. The attacker abuses that content pack's command-building logic to inject OS commands that run on the managed remote endpoints. Limiting factors: full administrative privilege on the SOAR/SIEM platform is mandatory (no unauthenticated or low-privilege path), no user interaction is required (UI:N), and exploitation is confined to environments that have deployed and operate the OS Query content pack rather than any default install.

This is a legitimate but not top-tier priority. The CVSS 4.0 base score of 6.1 (MEDIUM) is held down primarily by PR:H - the attacker must already be an authenticated administrator of the Cortex XSOAR/XSIAM platform. The input vector carries E:U (Exploit Unproven), there is no CISA KEV listing, no POC referenced, and no EPSS score was supplied, so all exploitation-maturity signals point to low immediate real-world risk: no public exploit identified at time of analysis and no evidence of active exploitation. Counterbalancing this, the technical impact is high across all three dimensions (VC:H/VI:H/VA:H) and the capability - arbitrary OS command execution on remote managed endpoints - is severe once the precondition is met, effectively turning a compromised or malicious SOAR administrator into a lateral-movement engine. In short: real issue, high technical impact, but the PR:H gate and unproven exploit status make it a patch-on-normal-cadence item rather than an emergency, unless the XSOAR/XSIAM admin trust boundary is weak in your environment. Note the possible scope question flagged below: the vendor set SC/SI/SA:N even though commands execute on remote endpoints - defenders should treat the blast radius as larger than the SOAR server itself.

An authenticated Cortex XSOAR/XSIAM administrator (or an attacker who has phished/compromised such an account) crafts malicious input to the OS Query content pack, which fails to sanitize it before building an OS command. The injected payload is executed as an arbitrary OS command on the remote endpoints the platform manages, giving full command execution across the fleet. No public exploit code is known, and because it is network-reachable with low attack complexity, exploitation is straightforward once administrator access is held.