PAN-OS CVE-2026-0286: Post-Auth CLI Command Injection Vulnerability Advisory

Vulnerability Overview CVE-2026-0286 PAN-OS: Authentication Command Injection in CLI CVSS Vector (Base): Medium Severity: Medium Description: A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS software allows an authenticated administrator to execute arbitrary OS commands as root. Attack Vector: Network Attack Complexity: Low User Interaction: None Privileges Required: High Confidentiality Impact: High Integrity Impact: High Availability Impact: None Subsequent Confidentiality Impact: None Subsequent Integrity Impact: None Subsequent Availability Impact: None Affected Versions Affected Versions: - PAN-OS 12.1: = 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 - PAN-OS 11.2: >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h11, >= 11.2.13 - PAN-OS 11.1: >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 - PAN-OS 10.2: >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 - Prisma Access: All Mitigation Steps PAN-OS 12.1: - 12.1.5 through 12.1.7-h: Upgrade to 12.1.7-h2, 12.1.8, or later. - 12.1.2 through 12.1.4-h: Upgrade to 12.1.4-h8, 12.1.8, or later. PAN-OS 11.2: - 11.2.11 through 11.2.12: Upgrade to 11.2.13 or later. - 11.2.8 through 11.2.10-h: Upgrade to 11.2.10-h11, 11.2.13, or later. - 11.2.5 through 11.2.7-h: Upgrade to 11.2.7-h18, 11.2.13, or later. - 11.2.0 through 11.2.4-h: Upgrade to 11.2.4-h20, 11.2.13, or later. PAN-OS 11.1: - 11.1.14 through 11.1.15: Upgrade to 11.1.16 or later. - 11.1.11 through 11.1.13-h: Upgrade to 11.1.13-h9, 11.1.16, or later. - 11.1.8 through 11.1.10-h: Upgrade to 11.1.10-h30, 11.1.16, or later. - 11.1.7 through 11.1.7-h: Upgrade to 11.1.7-h8, 11.1.16, or later. - 11.1.5 through 11.1.6-h: Upgrade to 11.1.6-h35, 11.1.16, or later. - 11.1.0 through 11.1.4-h: Upgrade to 11.1.4-h35, 11.1.16, or later. PAN-OS 10.2: - 10.2.17 through 10.2.18-h: Upgrade to 10.2.18-h8 or later. - 10.2.14 through 10.2.16-h: Upgrade to 10.2.16-h9 or later. - 10.2.11 through 10.2.13-h: Upgrade to 10.2.13-h23 or later. - 10.2.8 through 10.2.10-h: Upgrade to 10.2.10-h39 or later. - 10.2.0 through 10.2.7-h: Upgrade to 10.2.7-h36 or later. All older, unsupported PAN-OS versions: Upgrade to a supported, patched version. Prisma Access: No action required. Additional Information Workarounds and Mitigations: Limited threat prevention signature coverage is available to protect against this vulnerability by enabling threat ID 510036 (available in Application and Threat content versions 9122-10145 and later). Acknowledgments: Palo Alto Networks thanks Curious of TRAPA Security and its internal security research team for discovering and reporting this issue. FAQ: Reasons why the threat prevention signature provides limited coverage. CPEs: List of affected CPE identifiers. Timeline**: 2026-07-09 Initial release. Proof-of-Concept Code or Exploit Code No specific PoC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

PAN-OS CVE-2026-0286: Post-Auth CLI Command Injection Vulnerability Advisory