PAN-OS EUVD-2026-75255

Exploitation requires two simultaneous, specific conditions: (1) the attacker must be an authenticated PAN-OS administrator with active CLI access - PR:H per CVSS, meaning no unauthenticated exploitation path exists; and (2) the target device must be explicitly configured with a Luna Hardware Security Module (HSM) - devices not running Luna HSM are not vulnerable to this code path regardless of PAN-OS version. Limiting factors include the high privilege bar (admin credentials required), local/CLI access requirement (AV:L), and the Luna HSM deployment prerequisite, which is a niche configuration found primarily in regulated financial, government, or high-assurance enterprise environments. Panorama management servers, Cloud NGFW instances, and Prisma Access deployments are explicitly excluded. Further restricting which administrators can access the CLI reduces exposure.

The vendor-assigned CVSS 4.0 score of 4.0 (vector AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) is appropriate and conservative given the exploitation constraints. The high privilege requirement (PR:H - authenticated administrator) and local access vector (AV:L - CLI) mean an exploiting party already possesses significant trusted access to the device; the primary risk is privilege escalation from admin-level CLI restrictions to unrestricted root OS shell, bypassing PAN-OS access controls to reach the underlying Linux host. The AT:P metric captures the Luna HSM dependency, which limits exposure to a subset of PAN-OS deployments that use this specific hardware. No public exploit code is known (E:U in the provided CVSS 4.0 supplemental metrics), and the CISA KEV registry does not list this CVE. EPSS data was not provided in the source intelligence. The realistic threat actor pool is narrow: insiders or compromised admin credentials on HSM-equipped firewalls. Palo Alto explicitly notes that restricting CLI access to fewer administrators substantially reduces risk, confirming the attack surface is administrative-access-dependent.

An authenticated PAN-OS administrator connects to the CLI of a firewall configured with a Luna Hardware Security Module and submits a crafted command containing shell metacharacters within an HSM-related CLI function. The injected payload bypasses PAN-OS input sanitization and executes as the root OS user, granting the attacker unrestricted access to the underlying Linux host - enabling exfiltration of private key material from the HSM, persistent backdoor installation, or firewall configuration manipulation outside PAN-OS access controls. No public exploit code is known to exist.