This vulnerability (CVE-2026-0261) involves improper neutralization of special elements in OS commands (CWE-78) within Palo Alto Networks PAN-OS software. It allows authenticated administrators with CLI or Web UI access to run arbitrary commands as root, effectively bypassing system restrictions. The issue affects PAN-OS on physical and virtual firewall appliances and Panorama management platforms, but not the Cloud NGFW or Prisma Access services. Exploitation requires high privileges (administrator access) and local interaction with management interfaces. No vendor advisory or patch information is currently available, and the vendor recommends limiting CLI and web management access to trusted administrators and internal IP addresses to minimize risk.

Successful exploitation allows an authenticated administrator to execute arbitrary OS commands with root privileges, potentially leading to full system compromise of affected PAN-OS devices. This could bypass system restrictions and controls. However, exploitation requires high privilege access (administrator) to the CLI or Web UI, limiting the attack surface. Cloud NGFW and Prisma Access are not affected, reducing risk for those environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Meanwhile, Palo Alto Networks recommends restricting CLI access to a limited group of administrators and limiting management web interface access to trusted internal IP addresses as per their best practice deployment guidelines. These access restrictions significantly reduce the risk of exploitation.