CVE-2026-0286 is a high-severity authenticated command injection vulnerability in the PAN-OS CLI. It allows an attacker with admin-level CLI access to break out of the CLI sandbox and execute arbitrary commands on the underlying operating system. This vulnerability affects PAN-OS versions below 12.1.8, 11.2.13, 11.1.16, and 10.2.18-h8. Palo Alto Networks has released official patches for these versions. Cloud NGFW services are not impacted. A temporary mitigation is available through Threat Prevention subscription using Threat ID 510036 with content version 9122-10145 or later, but it only applies if inbound management traffic is decrypted. The definitive remediation is to apply the official patches.

Successful exploitation requires authenticated administrative CLI access, enabling arbitrary command execution on the underlying system. This can lead to full system compromise from an authorized user context. The vulnerability does not allow unauthenticated remote code execution, reducing its urgency compared to unauthenticated RCEs. However, environments with multiple administrators, shared credentials, or potential unauthorized CLI access are at risk. Cloud NGFW services are not affected, limiting impact to on-premises PAN-OS deployments.

Official patches are available for PAN-OS versions 12.1.8, 11.2.13, 11.1.16, and 10.2.18-h8 and should be applied promptly. If immediate patching is not possible and a Threat Prevention subscription is active, enable the temporary mitigation using Threat ID 510036 with content version 9122-10145 or later, noting it only applies if inbound management traffic is decrypted. Cloud NGFW customers do not need to take any action. Refer to the official Palo Alto Networks advisory at https://security.paloaltonetworks.com/CVE-2026-0286 for detailed guidance.