CVE-2026-0286

Опубликовано: 09 июл. 2026

Источник: nvd

CVSS3: 7.2

EPSS Низкий

Описание

A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root.

The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).

Cloud NGFW and Prisma Access® are not impacted by this vulnerability.

Ссылки

https://security.paloaltonetworks.com/CVE-2026-0286
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 10.2.0 (включая) до 10.2.7 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 10.2.8 (включая) до 10.2.10 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 10.2.11 (включая) до 10.2.13 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 10.2.14 (включая) до 10.2.16 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h11:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h12:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h13:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h14:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h15:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h16:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h17:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h18:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h19:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h20:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h21:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h22:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h23:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h24:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h32:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h34:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h35:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h8:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.7:h9:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h11:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h12:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h13:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h14:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h17:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h18:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h21:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h27:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h30:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h31:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h36:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h37:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.10:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h15:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h16:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h18:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h21:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h22:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.13:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.16:h8:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.17:*:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:10.2.18:h7:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 11.1.0 (включая) до 11.1.4 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 11.1.8 (включая) до 11.1.10 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 11.1.11 (включая) до 11.1.13 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 11.1.14 (включая) до 11.1.16 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h11:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h12:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h13:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h15:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h17:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h18:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h25:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h27:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h32:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h33:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h34:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h8:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.4:h9:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.5:*:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h14:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h17:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h18:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h19:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h20:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h21:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h22:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h23:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h25:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h29:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h32:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h33:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h34:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.6:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h12:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h21:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h25:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h26:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h27:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h28:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.10:h9:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.1.13:h8:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 11.2.0 (включая) до 11.2.4 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 11.2.5 (включая) до 11.2.7 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 11.2.8 (включая) до 11.2.10 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 11.2.11 (включая) до 11.2.13 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h11:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h12:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h14:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h15:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h17:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h18:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h8:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.4:h9:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h11:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h12:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h13:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h14:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h15:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h16:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h17:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.7:h8:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h1:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h10:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h4:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h8:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:11.2.10:h9:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 12.1.2 (включая) до 12.1.4 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:*:*:*:*:*:*:*:*

Версия от 12.1.5 (включая) до 12.1.7 (исключая)

cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h2:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h3:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h5:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h6:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:12.1.4:h7:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:-:*:*:*:*:*:*

cpe:2.3:o:paloaltonetworks:pan-os:12.1.7:h1:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.01019

Низкий

7.2 High

CVSS3

Дефекты

CWE-78

Связанные уязвимости

GHSA-fhqp-fjgf-qf28

CVSS3: 7.2

github

24 дня назад

A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access® are not impacted by this vulnerability.

BDU:2026-09542

CVSS3: 6.5

fstec

26 дней назад

Уязвимость интерфейса командной строки операционной системы PAN-OS, позволяющая нарушителю выполнить произвольные команды

EPSS

Процентиль: 60%

0.01019

Низкий

7.2 High

CVSS3

Дефекты

CWE-78