Medium · 6.1 CVE-2026-0313 EUVD-2026-101674GHSA-mxh3-wwwc-mx62

Cortex XSOAR: OS Command Injection Vulnerability

Published Oct 14, 2026 · Updated Oct 16, 2026 · Assigned by palo_alto

Vendor: Palo Alto Networks Product: Cortex XSIAM OS Query Product: Cortex XSOAR OS Query Category: Network devices

Description

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.

Affected products

Vendor	Product	Affected	Fixed
Palo Alto Networks	Cortex XSOAR OS Query	< 1.0.17	1.0.17
Palo Alto Networks	Cortex XSIAM OS Query	< 1.0.17	1.0.17

Advisories 1

WID-SEC-2026-3946 Palo Alto Networks Cortex XSOAR: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Oct 14, 2026

References

PAN-OS Security Advisory vendor-advisory