Command Injection Vulnerability in Palo Alto Networks PAN-OS Software

CVE-2026-0309

What is CVE-2026-0309?

A command injection vulnerability has been identified in Palo Alto Networks PAN-OS software, allowing authenticated administrators to bypass system restrictions and execute arbitrary commands with root access. This security issue requires the attacker to have access to the PAN-OS Command-Line Interface (CLI) and necessitates that the device is configured with a Luna Hardware Security Module (HSM). The potential exploit can be mitigated if CLI access is limited to a select group of administrators. Notably, devices running Panorama, Cloud NGFW, and Prisma Access are unaffected by this vulnerability.

References