Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-0309— PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration

Quick assessment

Affected

Palo Alto Networks Cloud NGFW

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Palo Alto Networks PAN-OS是美国Palo Alto Networks公司的一款集防火墙与入侵防御功能于一体的网络安全操作系统。 Palo Alto Networks PAN-OS 12.2.3之前版本、12.1.4-h10之前版本、11.2.4-h21之前版本、11.1.4-h36之前版本和10.2.7-h37之前版本存在命令注入漏洞，该漏洞源于命令注入，经过身份验证的管理员可绕过系统限制并以root用户执行任意命令。

CVSS 4.0 · Medium EPSS 0.78% · P56 Updated Oct 15, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1548 · Abuse Elevation Control Mechanism

Affected Version Matrix 7

Vendor	Product	Version Range	Status
Palo Alto Networks	Cloud NGFW	`All`	unaffected
Palo Alto Networks	PAN-OS	`12.2.0< 12.2.3`	affected
		`12.1.0< 12.1.4-h10`	affected
		`11.2.0< 11.2.4-h21`	affected
		`11.1.0< 11.1.4-h36`	affected
		`10.2.0< 10.2.7-h37`	affected
Palo Alto Networks	Prisma Access	`All< 12.1.4-h10`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-0309

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration

Source: CVE Program / CVE List V5

Vulnerability Description

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Vulnerability Title

Palo Alto Networks PAN-OS 命令注入漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Palo Alto Networks	Cloud NGFW	-	-
Palo Alto Networks	PAN-OS	12.2.0 ~ 12.2.3	`cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:::::::*`
Palo Alto Networks	Prisma Access	-	-

II. Public POCs for CVE-2026-0309

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-0309

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-0309 (1)

🔗 CVE-2026-0309 PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration Read full article vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-0309

Same Patch Batch · Palo Alto Networks · 2026-09-10 · 9 CVEs total

CVE-2026-0307	5.9 MEDIUM	GlobalProtect App: Local Privilege Escalation Vulnerabilities
CVE-2026-0306	5.8 MEDIUM	Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows
CVE-2026-0310	5.2 MEDIUM	PAN-OS: Buffer Overflow Vulnerability via XML Processing
CVE-2026-0304	4.8 MEDIUM	Cortex XDR Broker VM: Privilege Escalation Vulnerability
CVE-2026-0305	4.3 MEDIUM	Prisma Access Agent: Information Disclosure Vulnerability on Linux
CVE-2026-0303	2.4 LOW	Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File
CVE-2026-0302	1.1 LOW	Checkov by Prisma Cloud: OS Command Injection Vulnerability
CVE-2026-0308	0.4 LOW	PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

IV. Related Vulnerabilities

Same product: Cloud NGFW

Same vendor: Palo Alto Networks

Same weakness: CWE-78