CVE-2026-0273: Palo Alto PAN-OS RCE Vulnerability

CVE-2026-0273 Overview

CVE-2026-0273 is a command injection vulnerability [CWE-78] in Palo Alto Networks PAN-OS® software. An authenticated administrator can bypass system restrictions and run arbitrary commands as the root user. Exploitation requires access to the PAN-OS Command Line Interface (CLI) or Web UI.

The issue affects PAN-OS software running on PA-Series and VM-Series firewalls, and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected. The security risk is reduced when administrative access is limited to trusted internal IP addresses.

Critical Impact
An authenticated administrator can escalate from restricted shell access to full root command execution on the underlying PAN-OS operating system.

Affected Products

Palo Alto Networks PAN-OS on PA-Series firewalls
Palo Alto Networks PAN-OS on VM-Series firewalls
Palo Alto Networks Panorama (virtual and M-Series)

Discovery Timeline

2026-06-10 - CVE-2026-0273 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-0273

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. PAN-OS exposes administrative functions through a restricted CLI and a Web UI. One or more of these administrative functions pass user-supplied input into an operating system command without sufficient sanitization or argument separation.

An authenticated administrator can craft input containing shell metacharacters or command separators. The injected payload is executed by the underlying shell with root privileges, bypassing the restrictions that the PAN-OS administrative shell normally enforces. This converts a constrained administrative session into full operating system control.

The vulnerability requires authentication with high privileges, which limits opportunistic exploitation. However, it allows an administrator to break out of the documented PAN-OS command boundary, defeat audit and separation-of-duties controls, and pivot to the host operating system.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. PAN-OS constructs a system command string from administrator-supplied parameters and invokes it through a shell context. Because input is not strictly validated against an allow list or passed as separate process arguments, injected shell syntax is interpreted by the command processor.

Attack Vector

The attack vector is network-based against the PAN-OS management plane. An attacker must first obtain valid administrator credentials or hijack an authenticated session. Once authenticated, the attacker issues a crafted CLI command or Web UI request that embeds shell metacharacters in a vulnerable parameter. The PAN-OS process executes the injected command as root, granting access to configuration files, certificates, and the underlying file system. See the Palo Alto Networks CVE-2026-0273 Advisory for vendor-specific technical details.

Detection Methods for CVE-2026-0273

Indicators of Compromise

Administrative CLI or Web UI requests containing shell metacharacters such as ;, &&, |, backticks, or $() in command parameters.
Unexpected child processes spawned by PAN-OS management daemons, such as /bin/sh, bash, curl, wget, or nc.
New or modified files in administrator home directories, /tmp, or PAN-OS configuration directories outside scheduled maintenance windows.
Outbound network connections originating from the firewall management plane to untrusted destinations.

Detection Strategies

Enable and forward PAN-OS configuration and system logs to a centralized log platform for review of administrative command history.
Correlate administrator logins with subsequent command execution and flag commands containing shell control characters.
Baseline normal management-plane process activity and alert on deviations such as shell interpreters launched by management services.

Monitoring Recommendations

Forward PAN-OS audit logs to a SIEM and retain administrator command-line content for forensic review.
Monitor authentication events for the superuser and other administrator roles, including source IP and session duration.
Alert on any management-plane traffic sourced from networks outside the approved administrative range.

How to Mitigate CVE-2026-0273

Immediate Actions Required

Apply the fixed PAN-OS versions listed in the Palo Alto Networks CVE-2026-0273 Advisory as soon as maintenance windows allow.
Restrict Web UI and CLI access to a dedicated management network and trusted internal IP addresses only.
Review the list of accounts with administrator privileges and remove unused or shared accounts.
Rotate administrator credentials and API keys if compromise is suspected.

Patch Information

Palo Alto Networks has published fixed PAN-OS versions in the vendor advisory. Administrators should consult the advisory for the specific fixed releases that correspond to their deployed PAN-OS train and upgrade Panorama before managed firewalls where applicable.

Workarounds

Limit CLI access to a small, audited group of administrators following Palo Alto Networks best practice deployment guidelines.
Restrict access to the management Web interface to trusted internal IP addresses through management profiles and access control lists.
Enforce multi-factor authentication for all administrative accounts to raise the bar for credential abuse.
Place the management interface on an out-of-band network that is not reachable from user or internet-facing segments.

bash

# Configuration example: restrict management access on PAN-OS
set deviceconfig system permitted-ip 10.10.0.0/24
set deviceconfig system permitted-ip 10.10.1.0/24
set network interface management-profile mgmt-restrict https yes ssh yes ping yes
set network interface management-profile mgmt-restrict permitted-ip 10.10.0.0/24
commit