Cortex Xsiam Os Query
Monthly
Arbitrary OS command execution on managed remote endpoints is possible in Palo Alto Networks Cortex XSOAR and Cortex XSIAM deployments that use the OS Query content pack, where an authenticated administrator can exploit command injection in the pack's command-building logic. Affected environments are limited to those with the OS Query content pack installed and operational; exploitation requires high administrative privileges and no user interaction. No public exploit has been identified at time of analysis, and the risk is assessed as legitimate but not top-tier priority given the privileged access prerequisite.
Arbitrary OS command execution on managed remote endpoints is possible in Palo Alto Networks Cortex XSOAR and Cortex XSIAM deployments that use the OS Query content pack, where an authenticated administrator can exploit command injection in the pack's command-building logic. Affected environments are limited to those with the OS Query content pack installed and operational; exploitation requires high administrative privileges and no user interaction. No public exploit has been identified at time of analysis, and the risk is assessed as legitimate but not top-tier priority given the privileged access prerequisite.