PAN-OS: Authenticated Command Injection in CLI

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• paloaltonetworks pan-os11.2.11 and later · before 11.2.13
• paloaltonetworks pan-os10.2.8 and later · before 10.2.10
• paloaltonetworks pan-os10.2.11 and later · before 10.2.13
• paloaltonetworks pan-os10.2.14 and later · before 10.2.16
• paloaltonetworks pan-os11.1.8 and later · before 11.1.10
• paloaltonetworks pan-os11.1.11 and later · before 11.1.13
• paloaltonetworks pan-os11.1.14 and later · before 11.1.16
• paloaltonetworks pan-os10.2.0 and later · before 10.2.7
• paloaltonetworks pan-os12.1.5 and later · before 12.1.7
• paloaltonetworks pan-os11.2.0 and later · before 11.2.4
• paloaltonetworks pan-os11.2.5 and later · before 11.2.7
• paloaltonetworks pan-os11.2.8 and later · before 11.2.10
• paloaltonetworks pan-os12.1.2 and later · before 12.1.4
• paloaltonetworks pan-os11.1.0 and later · before 11.1.4
• paloaltonetworks pan-os10.2.10
• paloaltonetworks pan-os10.2.13
• paloaltonetworks pan-os10.2.16
• paloaltonetworks pan-os10.2.17
• paloaltonetworks pan-os10.2.18
• paloaltonetworks pan-os10.2.7

Versions reported by the vendor

Affected version ranges reported by the assigning authority (palo_alto). Independent of NVD's CPE analysis and usually ahead of it.

• Palo Alto Networks Cloud NGFW

  • Allnot affected

• Palo Alto Networks PAN-OS

  • 12.1.0 and later · before 12.1.8affectedfixed in 12.1.8, 12.1.7-h2, 12.1.4-h8
  • 11.2.0 and later · before 11.2.13affectedfixed in 11.2.13, 11.2.10-h11, 11.2.7-h18, 11.2.4-h20
  • 11.1.0 and later · before 11.1.16affectedfixed in 11.1.16, 11.1.13-h9, 11.1.10-h30, 11.1.7-h8, 11.1.6-h35, 11.1.4-h35
  • 10.2.0 and later · before 10.2.18-h8affectedfixed in 10.2.18-h8, 10.2.16-h9, 10.2.13-h23, 10.2.10-h39, 10.2.7-h36

• Palo Alto Networks Prisma Access

  • Allnot affected

Other highest-scoring records for the same primary product.

• CVE-2024-3400PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtectKEV
  100Now
• CVE-2017-15944Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to executeKEV
  98Now
• CVE-2024-0012PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)KEV
  97Now
• CVE-2025-0108PAN-OS: Authentication Bypass in the Management Web InterfaceKEV
  95Now
• CVE-2026-0257PAN-OS: GlobalProtect Authentication Bypass VulnerabilitiesKEV
  90Now
• CVE-2024-9474PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management InterfaceKEV
  85Now

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.