A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root.
The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
"}]}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0286","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER","version":"4.0","baseSeverity":"MEDIUM","baseScore":6,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber"}}],"configurations":[{"lang":"eng","value":"No special configuration is required to be affected by this issue.","supportingMedia":[{"type":"text/html","base64":false,"value":"No special configuration is required to be affected by this issue."}]}],"workarounds":[{"lang":"eng","value":"Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510036 (from Applications and Threats content version 9122-10145 and later). For these Threat IDs to protect against attacks for this vulnerability:\n\n\n\n\n\n * Route incoming traffic for the MGT port through a DP port https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id59206398-3dab-4b2f-9b4b-7ea500d036ba , e.g., enabling management profile on a DP interface for management access.\n * Replace the Certificate for Inbound Traffic Management https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id112f7714-8995-4496-bbf9-781e63dec71c . \n * Decrypt inbound traffic to the management interface so the firewall can inspect it. https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#idbbd82587-17a2-42b4-9245-d3714e1e13a2 \n * Enable threat prevention on the inbound traffic to management services.\n\n\n\n\n\n\n\n\nPlease note that this Threat ID requires SSL Decryption.","supportingMedia":[{"type":"text/html","base64":false,"value":"Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510036 (from Applications and Threats content version 9122-10145 and later). For these Threat IDs to protect against attacks for this vulnerability:
Please note that this Threat ID requires SSL Decryption.
"}]}],"solutions":[{"lang":"eng","value":"Version\nMinor Version\nSuggested Solution\nCloud NGFW All\nNo action needed.\n PAN-OS 12.1\n\n 12.1.5 through 12.1.7-h*\n Upgrade to 12.1.7-h2 or 12.1.8 or later.\n \n \n 12.1.2 through 12.1.4-h*\n Upgrade to 12.1.4-h8 or 12.1.8 or later.\n \n PAN-OS 11.2\n\n 11.2.11 through 11.2.12\n Upgrade to 11.2.13 or later.\n \n \n 11.2.8 through 11.2.10-h*\n Upgrade to 11.2.10-h11 or 11.2.13 or later.\n \n \n 11.2.5 through 11.2.7-h*\n Upgrade to 11.2.7-h18 or 11.2.13 or later.\n \n \n 11.2.0 through 11.2.4-h*\n Upgrade to 11.2.4-h20 or 11.2.13 or later.\n \n PAN-OS 11.1\n\n 11.1.14 through 11.1.15\n Upgrade to 11.1.16 or later.\n \n \n 11.1.11 through 11.1.13-h*\n Upgrade to 11.1.13-h9 or 11.1.16 or later.\n \n \n 11.1.8 through 11.1.10-h*\n Upgrade to 11.1.10-h30 or 11.1.16 or later.\n \n \n 11.1.7 through 11.1.7-h*\n Upgrade to 11.1.7-h8 or 11.1.16 or later.\n \n \n 11.1.5 through 11.1.6-h*\n Upgrade to 11.1.6-h35 or 11.1.16 or later.\n \n \n 11.1.0 through 11.1.4-h*\n Upgrade to 11.1.4-h35 or 11.1.16 or later.\n \n PAN-OS 10.2\n\n 10.2.17 through 10.2.18-h*\n Upgrade to 10.2.18-h8 or later.\n \n \n 10.2.14 through 10.2.16-h*\n Upgrade to 10.2.16-h9 or later.\n \n \n 10.2.11 through 10.2.13-h*\n Upgrade to 10.2.13-h23 or later.\n \n \n 10.2.8 through 10.2.10-h*\n Upgrade to 10.2.10-h39 or later.\n \n \n 10.2.0 through 10.2.7-h*\n Upgrade to 10.2.7-h36 or later.\n All older\nunsupported\nPAN-OS versions Upgrade to a supported fixed version.Prisma Access \n\nNo action needed.","supportingMedia":[{"type":"text/html","base64":false,"value":"| Version | Minor Version | Suggested Solution |
|---|---|---|
| Cloud NGFW All | No action needed. | |
| PAN-OS 12.1 | \n 12.1.5 through 12.1.7-h* | \nUpgrade to 12.1.7-h2 or 12.1.8 or later. | \n
| \n | 12.1.2 through 12.1.4-h* | \nUpgrade to 12.1.4-h8 or 12.1.8 or later. | \n
| PAN-OS 11.2 | \n 11.2.11 through 11.2.12 | \nUpgrade to 11.2.13 or later. | \n
| \n | 11.2.8 through 11.2.10-h* | \nUpgrade to 11.2.10-h11 or 11.2.13 or later. | \n
| \n | 11.2.5 through 11.2.7-h* | \nUpgrade to 11.2.7-h18 or 11.2.13 or later. | \n
| \n | 11.2.0 through 11.2.4-h* | \nUpgrade to 11.2.4-h20 or 11.2.13 or later. | \n
| PAN-OS 11.1 | \n 11.1.14 through 11.1.15 | \nUpgrade to 11.1.16 or later. | \n
| \n | 11.1.11 through 11.1.13-h* | \nUpgrade to 11.1.13-h9 or 11.1.16 or later. | \n
| \n | 11.1.8 through 11.1.10-h* | \nUpgrade to 11.1.10-h30 or 11.1.16 or later. | \n
| \n | 11.1.7 through 11.1.7-h* | \nUpgrade to 11.1.7-h8 or 11.1.16 or later. | \n
| \n | 11.1.5 through 11.1.6-h* | \nUpgrade to 11.1.6-h35 or 11.1.16 or later. | \n
| \n | 11.1.0 through 11.1.4-h* | \nUpgrade to 11.1.4-h35 or 11.1.16 or later. | \n
| PAN-OS 10.2 | \n 10.2.17 through 10.2.18-h* | \nUpgrade to 10.2.18-h8 or later. | \n
| \n | 10.2.14 through 10.2.16-h* | \nUpgrade to 10.2.16-h9 or later. | \n
| \n | 10.2.11 through 10.2.13-h* | \nUpgrade to 10.2.13-h23 or later. | \n
| \n | 10.2.8 through 10.2.10-h* | \nUpgrade to 10.2.10-h39 or later. | \n
| \n | 10.2.0 through 10.2.7-h* | \nUpgrade to 10.2.7-h36 or later. | \n
| All older unsupported PAN-OS versions | Upgrade to a supported fixed version. | |
| Prisma Access | No action needed. |