CVE-2026-0273: PAN-OS Command Injection Allows Root Access via Admin UI

Technical summary

This is a CWE-78 OS command injection vulnerability present in the PAN-OS management plane. An authenticated principal with access to either the CLI or Web UI can craft input that bypasses system restrictions and executes arbitrary commands in the context of the root user. The attack has a network-based attack vector, requires high privileges (authenticated admin), and causes high impact across confidentiality, integrity, and availability. The vulnerability scores 7.2 (HIGH) under CVSS 3.1 due to the requirement for prior authentication, which restricts the attack surface but leaves privileged insiders and compromised credentials as critical risk factors.

Business impact

Successful exploitation could allow an attacker with admin credentials to gain unrestricted root-level control of critical perimeter infrastructure. This enables data exfiltration, configuration tampering, traffic inspection/hijacking, and denial of service. For organizations relying on Palo Alto firewalls as a foundational security control, compromise of the management plane translates to compromise of the entire security posture. The impact is especially severe if the attacker covers their tracks by modifying logs or disabling security rules. Organizations should treat this as a credential-hygiene and privileged-access-management issue as much as a patch issue.

Affected systems

PAN-OS running on PA-Series physical firewalls, VM-Series virtual instances, Panorama (including virtual and M-Series appliances). Cloud NGFW and Prisma Access deployments are not vulnerable. Any deployment with one or more of these systems in the network perimeter is potentially at risk if management access is not tightly controlled.

Exploitability

Exploitation requires valid administrative credentials and network-layer access to the management interface—either the CLI (SSH/telnet) or Web UI (HTTPS). An attacker cannot exploit this remotely without first compromising or socially engineering an admin account. However, the ease of command injection exploitation once authenticated, combined with the high-value nature of firewall admin access, makes this a realistic threat vector in insider and credential-compromise scenarios. The barrier to exploitation is authentication; the barrier to impact is minimal once inside.

Remediation

Apply vendor patches when released. In parallel, immediately audit administrative access: enforce multi-factor authentication on all admin accounts, rotate credentials, and review recent admin activity logs for anomalies. Restrict CLI and Web UI access by source IP to a hardened jump host or management network, and disable unnecessary management protocols. Implement role-based access control to limit administrative scope where feasible. Monitor for suspicious command-line activity and API calls originating from the management plane.

Patch guidance

Consult the Palo Alto Networks security advisory for affected PAN-OS versions and available patches. Patches will likely be released as minor or maintenance updates. Establish a phased rollout plan for production firewalls, testing in a staging environment first. Prioritize appliances with the highest exposure (those with broader admin access or internet-facing management). Verify patch installation by confirming the updated version in the system information dashboard.

Detection guidance

Monitor management interface access logs for unusual login times, geographic anomalies, or failed authentication bursts. Instrument firewall audit logs and syslog forwarding to detect command-line activity that appears out of policy (for example, shell meta-characters, redirects, or privilege escalation attempts in admin CLI sessions). Correlate access logs with identity directory changes or credential rotation events. SIEM rules should flag rapid CLI commands or API calls from a single session that modify security policies or export sensitive data.

Why prioritize this

This is a HIGH-severity flaw affecting core infrastructure. While authentication is required, the ease of exploitation post-compromise and the critical role of perimeter firewalls justify urgent remediation. Organizations with weak privileged-access controls or public-facing management interfaces should prioritize this above routine patches. The absence of KEV or active exploitation reports does not diminish urgency—this is a pre-emptive vulnerability that should be patched before adversaries recognize its value.

Risk score, explained

CVSS 7.2 (HIGH) reflects the combination of network accessibility, high-privilege requirement, and high impact (confidentiality, integrity, availability all compromised). The score is not CRITICAL because exploitation mandates prior authentication. However, the real-world risk may trend higher in organizations with poor credential hygiene, legacy privileged-access management, or widespread admin account sharing—factors not captured in CVSS but critical to risk assessment.

Frequently asked questions