This vulnerability (CVE-2026-0273) involves improper neutralization of special elements in OS commands (CWE-78) within Palo Alto Networks PAN-OS software. An authenticated administrator with access to the CLI or Web UI can bypass system restrictions and execute arbitrary commands with root privileges. The issue affects physical and virtual PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), but not the Cloud NGFW or Prisma Access services. The vulnerability has a CVSS 4.0 score of 6.1 (medium severity). No vendor advisory or patch information is currently available, and the remediation level is unknown.

An authenticated administrator can execute arbitrary OS commands as root, potentially compromising the entire system. This could lead to full system control, data compromise, or disruption of firewall operations. However, the vulnerability requires authenticated access to management interfaces, limiting exposure to trusted administrators. Cloud NGFW and Prisma Access are not affected.

No official patch or remediation has been confirmed. The vendor recommends minimizing risk by restricting CLI access to a limited group of administrators and limiting management web interface access to trusted internal IP addresses following Palo Alto Networks' best practice deployment guidelines. Monitor the vendor advisory for updates on patch availability and apply official fixes once released.