CVE-2026-0286: A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root.

unknownCVE-2026-0286

A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access® are not impacted by this vulnerability.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-07-09
Last updated: 2026-07-09
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-0286

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-02861.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 62% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-0286	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Palo Alto Networks PAN-OS: Multiple vulnerabilitiescert-bund
unknownPalo Alto Products Multiple Vulnerabilitieshkcert
mediumCVE-2026-0286 PAN-OS: Authenticated Command Injection in CLI (Severity: MEDIUM)paloalto

Recent advisories for A command injection

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-15081: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabi…nvd · 2026-07-10
unknownCVE-2026-13242: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabi…nvd · 2026-07-10
criticalGHSA-m93h-4hw7-5qcm: File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentic…ghsa · 2026-07-10
criticalCVE-2026-5801: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerabil…nvd · 2026-07-10
highCVE-2025-30007: HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows…nvd · 2026-07-10
criticalCVE-2026-2397: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerabil…nvd · 2026-07-10