CVE-2026-0273

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Affected products

Pa-Series, Pan-Os, Panorama, Vm Series

Paloaltonetworks Pan-os

< 10.2.7, 10.2.10, 10.2.13, 10.2.16, 10.2.17, 10.2.18

CVSS 4.0

8.6 HIGH

CVSS 3.1

7.2 HIGH

EPSS

1.3% (69th percentile)

Weakness

CWE-78

NVD status

Modified

Published

2026-06-10

Attack patterns

CAPEC-248