A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and… (CVE-2026-0309)
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
AI Analysis
Technical Summary
This vulnerability in PAN-OS software enables an authenticated administrator who has CLI access on a device configured with a Luna HSM to perform command injection, thereby bypassing system restrictions and executing arbitrary commands with root privileges. The vulnerability specifically affects PAN-OS and does not impact Panorama, Cloud NGFW, or Prisma Access. The attack vector requires local access with high privileges, and the presence of the Luna HSM configuration is a prerequisite for exploitation.
Potential Impact
An authenticated administrator with CLI access on a PAN-OS device configured with a Luna HSM can bypass system restrictions and run arbitrary commands as root, potentially leading to full system compromise. The impact is mitigated by restricting CLI access to trusted administrators only. No known exploits are reported in the wild.
Mitigation Recommendations
No official patch or fix status is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Restrict CLI access strictly to a limited group of trusted administrators to minimize risk. Monitor vendor communications for updates regarding patches or official mitigations.
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and… (CVE-2026-0309)
Description
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
CVSS v4.0
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in PAN-OS software enables an authenticated administrator who has CLI access on a device configured with a Luna HSM to perform command injection, thereby bypassing system restrictions and executing arbitrary commands with root privileges. The vulnerability specifically affects PAN-OS and does not impact Panorama, Cloud NGFW, or Prisma Access. The attack vector requires local access with high privileges, and the presence of the Luna HSM configuration is a prerequisite for exploitation.
Potential Impact
An authenticated administrator with CLI access on a PAN-OS device configured with a Luna HSM can bypass system restrictions and run arbitrary commands as root, potentially leading to full system compromise. The impact is mitigated by restricting CLI access to trusted administrators only. No known exploits are reported in the wild.
Mitigation Recommendations
No official patch or fix status is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Restrict CLI access strictly to a limited group of trusted administrators to minimize risk. Monitor vendor communications for updates regarding patches or official mitigations.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-w29c-3xrj-p9j4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-0309"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6aa2af83acd9273b4925b3ef
Added to database: 09/10/2026, 13:24:19 UTC
Last enriched: 09/10/2026, 13:36:23 UTC
Last updated: 09/10/2026, 17:00:36 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.