CVE-2026-0273 PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI (Severity: MEDIUM)

CSIRTS triage

What

There is an authenticated admin command injection vulnerability via CLI or Web UI.

Who is affected

Administrators using PAN-OS are affected.

Urgency

Remediation is necessary due to the medium severity of the vulnerability.

Action

Update to the latest version of PAN-OS.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

Palo Alto Networks Security Advisories (INTL · vendor-psirt · site)

Severity

medium

Published

2026-06-11

Exploitation

Not in CISA KEV at last sync

Original advisory: https://security.paloaltonetworks.com/CVE-2026-0273

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Moderate exploitation riskCVE-2026-02731.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• criticalSiemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFWcisa
• unknownNCSC-2026-0229 [1.00] [M/H] Vulnerabilities fixed in Siemens productsncsc-nl

More from Palo Alto Networks Security Advisories

• highPAN-SA-2026-0011 Chromium: Monthly Vulnerability Update (August 2026) (Severity: HIGH)2026-08-12
• lowCVE-2026-0301 PAN-OS: Information Disclosure Vulnerability in URL Filtering (Severity: LOW)2026-08-12
• mediumCVE-2026-0299 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM)2026-08-12
• mediumCVE-2026-0296 GlobalProtect App: Improper Certificate Validation Bypass Vulnerability (Severity: MEDIUM)2026-08-12
• mediumCVE-2026-0294 Prisma Access Agent: Local Privilege Escalation (Severity: MEDIUM)2026-08-12