CVE-2026-0286: PAN-OS: Authenticated Command Injection in CLI

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-09 · updated 2026-08-11
Weakness: CWE-78

Description

A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access® are not impacted by this vulnerability.

Affected products

Palo Alto Networks PAN-OS: from 10.2.0 before 10.2.7; from 10.2.8 before 10.2.10; from 10.2.11 before 10.2.13; from 10.2.14 before 10.2.16; from 11.1.0 before 11.1.4; from 11.1.8 before 11.1.10 — fixed in 10.2.10, 10.2.13, 10.2.16, 10.2.7, 11.1.10, 11.1.13

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.2.10, 10.2.13, 10.2.16, 10.2.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-0286 or the next vulnerability affects your stack