CVE-2026-0261

Vulnerability

Overview

CVE-2026-0261 describes multiple command injection vulnerabilities in Palo Alto Networks PAN-OS software. The root cause is insufficient input validation, allowing an authenticated administrator to bypass system restrictions and run arbitrary commands as the root user. The issue affects PAN-OS on PA-Series and VM-Series firewalls, as well as Panorama (virtual and M-Series and virtual appliances. Cloud NGFW and Prisma Access are not impacted [1].

Exploitation

Prerequisites

To exploit this vulnerability, an attacker must have valid administrative credentials and access to either the PAN-OS CLI or the Web UI. The attack surface is therefore limited to users who already possess administrative privileges. Palo Alto Networks notes that the risk is significantly reduced when management access is restricted to trusted internal IP addresses and CLI access is limited to a small group of administrators, following recommended best practices [1].

Impact

Successful exploitation allows an authenticated administrator to execute arbitrary commands with root-level privileges on the affected device. This could lead to full compromise of the firewall or Panorama appliance, including the system, including data exfiltration, configuration changes, or lateral movement within the network. The vendor states that no special configuration is required for a system to be vulnerable, and no malicious exploitation has been observed as of the publication date [1].

Mitigation

Palo Alto Networks has released security updates to address these vulnerabilities. Customers with a Threat Prevention subscription can also block attacks by enabling specific Threat IDs (510017, 510024, and others) from Applications and Threats content version 9100-10044 and later. The vendor strongly recommends restricting management interface access to trusted internal IP addresses as a best practice [1].