PAN-OS: Command Injection Vulnerability
- Severity
- High7.2CVSS 3.1, High
- Known exploited
- Not listed
- Exploit prediction
- 1%
- Published
- 11 Sept 2024Updated 17 Jun 2026 · Last verified 29 Sept 2026
Known remediation
Fixed releases per branch, as the vendor states them. Patcharo never infers a fix.
Palo Alto Networks PAN-OS
Vendor advisory- 11.2No fix published
Workaround / Vendor remediation
Vendor remediation · PAN-OS
This issue is fixed in PAN-OS 11.2.3 and all later PAN-OS versions.
Description
Title, description and vendor guidance are quoted from the source records.
A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall.
Weakness: CWE-78
Known exploited
Not listed in CISA KEV as of the last check.
Exploit prediction
1% probability of exploitation in the next 30 days (percentile 72%).
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the source states, per branch
Versions matched by Patcharo
Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)
| Branch | Affected | Fixed in |
|---|---|---|
| 11.2 | >= 11.2.2 | No fix published |
Versions not listed are stated unaffected by the vendor.
References
Provenance
Every fact on this page comes from the sources below. Nothing is written by an AI.
- Palo Alto Networks (CVE record)
- Palo Alto Networks (CVE record) · 29 Sept 2026 at 03:17 UTC · Parser patcharo-cve5/1.1.0
- NVD
- NVD · 27 Sept 2026 at 23:44 UTC · Parser patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 30 Sept 2026 at 00:17 UTC · Parser patcharo-epss/1.0.0
Last verified: 29 Sept 2026 at 03:17 UTC