CVE-2026-0313 Cortex XSOAR: OS Command Injection Vulnerability
Description
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cortex XSIAM OS Query | < 1.0.17 | >= 1.0.17 |
| Cortex XSOAR OS Query | < 1.0.17 | >= 1.0.17 |
Required Configuration for Exposure
This issue requires the OS Query content pack and the SSH integration to be installed and configured in Cortex XSOAR or Cortex XSIAM.
Severity: MEDIUM, Suggested Urgency: MODERATE
CVSS-BT: 6.1 / CVSS-B: 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type and Impact
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Solution
| Version | Minor Version | Suggested Solution |
|---|---|---|
| Cortex XSOAR OS Query | Update to 1.0.17 or later from the Cortex XSOAR Marketplace. | |
| Cortex XSIAM OS Query | Update to 1.0.17 or later from the Cortex XSOAR Marketplace. |
Workarounds and Mitigations
Customers who are unable to upgrade immediately can mitigate this issue by disabling the OSQueryBasicQuery automation in Cortex XSOAR or Cortex XSIAM.
Acknowledgments
CPE Applicability
- cpe:2.3:a:palo_alto_networks:cortex_xsoar_os_query:*:*:*:*:*:*:*:* is vulnerable from (including)1.0.0 and up to (excluding)1.0.17
- or
- cpe:2.3:a:palo_alto_networks:cortex_xsiam_os_query:*:*:*:*:*:*:*:* is vulnerable from (including)1.0.0 and up to (excluding)1.0.17