PSA: PAN-OS authenticated command injection in the CLI (CVE-2026-0286) - patches out for 12.1, 11.2, 11.1, 10.2
CVE-2026-0286 is an authenticated command injection vulnerability in the PAN-OS CLI that allows an attacker with administrative CLI access to execute arbitrary commands on the underlying system by escaping the CLI environment. The vulnerability affects PAN-OS versions prior to 12.1.8, 11.2.13, 11.1.16, and 10.2.18-h8. Cloud NGFW services are not affected. Palo Alto Networks has released patches for these versions. A temporary mitigation is available via Threat Prevention subscription with Threat ID 510036, but it requires inbound management traffic decryption and is not a full fix. Patching is the recommended remediation.
AI Analysis
Technical Summary
CVE-2026-0286 is an authenticated command injection vulnerability in the PAN-OS CLI. An attacker with administrative CLI access can escape the CLI environment and execute arbitrary commands on the underlying system. This vulnerability affects PAN-OS versions prior to 12.1.8, 11.2.13, 11.1.16, and 10.2.18-h8. Palo Alto Networks has released patches for these versions. Cloud NGFW services are not affected. A temporary mitigation is available via Threat Prevention subscription with Threat ID 510036, which requires inbound management traffic decryption but does not fully remediate the issue. The recommended remediation is to apply the official patches.
Potential Impact
An attacker with administrative CLI access can execute arbitrary commands on the underlying system by escaping the CLI environment. This could lead to unauthorized system control or compromise. The vulnerability requires authenticated access, so it is less urgent than unauthenticated remote code execution but still poses a significant risk, especially in environments with multiple administrators or shared credentials.
Mitigation Recommendations
Palo Alto Networks has released official patches for PAN-OS versions 12.1.8, 11.2.13, 11.1.16, and 10.2.18-h8 that fully address this vulnerability. Applying these patches is the recommended remediation. For environments unable to patch immediately, a temporary mitigation is available via Threat Prevention subscription using Threat ID 510036, but it requires inbound management traffic decryption and does not fully fix the issue. Cloud NGFW services are not affected and require no action.
PSA: PAN-OS authenticated command injection in the CLI (CVE-2026-0286) - patches out for 12.1, 11.2, 11.1, 10.2
Description
CVE-2026-0286 is an authenticated command injection vulnerability in the PAN-OS CLI that allows an attacker with administrative CLI access to execute arbitrary commands on the underlying system by escaping the CLI environment. The vulnerability affects PAN-OS versions prior to 12.1.8, 11.2.13, 11.1.16, and 10.2.18-h8. Cloud NGFW services are not affected. Palo Alto Networks has released patches for these versions. A temporary mitigation is available via Threat Prevention subscription with Threat ID 510036, but it requires inbound management traffic decryption and is not a full fix. Patching is the recommended remediation.
Reddit Discussion
Palo Alto put out an advisory for CVE-2026-0286, a command injection bug in the PAN-OS CLI. It's authenticated, so an attacker needs admin/CLI access, but with that they can break out of the CLI and run arbitrary commands on the underlying system. Lower urgency than an unauth RCE, but still worth patching, especially if you've got multiple admins, shared creds, or any path that could lead to CLI access getting popped.
Affected: PAN-OS below 12.1.8, 11.2.13, 11.1.16, and 10.2.18-h8
First fixed releases: 12.1.8, 11.2.13, 11.1.16, 10.2.18-h8. There are earlier hotfix builds per branch too if you can't jump straight to those.
Cloud NGFW isn't affected, no action needed there.
If you can't patch right away and you have a Threat Prevention subscription, there's a temporary mitigation via Threat ID 510036 (content version 9122-10145 or later), but it only helps if you're already decrypting inbound management traffic, so it's not a quick toggle for most setups. Patching is still the actual fix.
Official Palo Alto advisory:
https://security.paloaltonetworks.com/CVE-2026-0286
Side note, I run a small advisory tracker (VulniPulse) and there's a Discord for exactly this. If you want alerts like this hitting your inbox the second they drop, join the server and add the Palo Alto CVE alert, it'll ping you in Discord and email you the moment a new one lands, same as it did when this one hit.
https://discord.gg/r2Y5kHsfMr
Links cited in this discussion
Affected software
pkg:github/paloaltonetworks/pan-osRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-0286 is an authenticated command injection vulnerability in the PAN-OS CLI. An attacker with administrative CLI access can escape the CLI environment and execute arbitrary commands on the underlying system. This vulnerability affects PAN-OS versions prior to 12.1.8, 11.2.13, 11.1.16, and 10.2.18-h8. Palo Alto Networks has released patches for these versions. Cloud NGFW services are not affected. A temporary mitigation is available via Threat Prevention subscription with Threat ID 510036, which requires inbound management traffic decryption but does not fully remediate the issue. The recommended remediation is to apply the official patches.
Potential Impact
An attacker with administrative CLI access can execute arbitrary commands on the underlying system by escaping the CLI environment. This could lead to unauthorized system control or compromise. The vulnerability requires authenticated access, so it is less urgent than unauthenticated remote code execution but still poses a significant risk, especially in environments with multiple administrators or shared credentials.
Mitigation Recommendations
Palo Alto Networks has released official patches for PAN-OS versions 12.1.8, 11.2.13, 11.1.16, and 10.2.18-h8 that fully address this vulnerability. Applying these patches is the recommended remediation. For environments unable to patch immediately, a temporary mitigation is available via Threat Prevention subscription using Threat ID 510036, but it requires inbound management traffic decryption and does not fully fix the issue. Cloud NGFW services are not affected and require no action.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Domain
- null
- Newsworthiness Assessment
- {"score":56,"reasons":["external_link","newsworthy_keywords:cve-,patch","security_identifier","established_author","recent_news"],"isNewsworthy":true,"foundNewsworthy":["cve-","patch"],"foundNonNewsworthy":[]}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6a4ef5a6c9d9e3dbe32a9775
Added to database: 07/09/2026, 01:13:10 UTC
Last enriched: 08/11/2026, 12:53:28 UTC
Last updated: 08/22/2026, 10:52:07 UTC
Views: 307
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.