This vulnerability (CVE-2026-0273) involves improper neutralization of special elements in OS commands (CWE-78) within Palo Alto Networks PAN-OS software. An authenticated administrator with access to the CLI or Web UI can exploit this flaw to run arbitrary commands with root privileges, bypassing system restrictions. The issue impacts PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not affected. The vulnerability requires high privileges (authenticated admin) and network access, with no user interaction needed. The CVSS 4.0 base score is 6.1 (medium severity). No vendor advisory or patch information is currently available.

An authenticated administrator can execute arbitrary OS commands as root, potentially leading to full system compromise of affected PAN-OS devices. This could allow bypassing system restrictions and unauthorized control over firewall or management appliances. The impact is limited by the requirement for authenticated admin access and access to CLI or Web UI interfaces. Cloud NGFW and Prisma Access are not vulnerable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, risk can be mitigated by strictly limiting CLI access to a small group of trusted administrators and restricting management web interface access to trusted internal IP addresses, following Palo Alto Networks' best practice deployment guidelines.