CVE-2016-3655

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-04-12 · updated 2026-06-17
Weakness: CWE-20

Description

The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.

Affected products

Palo Alto Networks PAN-OS: from 5.0.0 before 5.0.18; from 5.1 before 5.1.11; from 6.0.0 before 6.0.13; from 6.1.0 before 6.1.10; from 7.0.0 through 7.0.5 — fixed in 5.0.18, 5.1.11, 6.0.13, 6.1.10

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 5.0.18, 5.1.11, 6.0.13, 6.1.10. Check the vendor advisory for mitigations.

References

https://security.paloaltonetworks.com/CVE-2016-3655
https://security.paloaltonetworks.com/CVE-2016-3655

Get alerted when CVE-2016-3655 or the next vulnerability affects your stack