CVE-2026-0309

Awaiting Analysis Awaiting Analysis - Queue

Command Injection in Palo Alto PAN-OS with Luna HSM

Publication date: 2026-09-10

Last updated on: 2026-09-11

Assigner: Palo Alto Networks, Inc.

Description

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-11

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-0309

EUVD

EUVD-2026-75255

Affected Vendors & Products

Vendor	Product	Version / Range
palo_alto_networks	pan-os	10.2
palo_alto_networks	pan-os	11.1
palo_alto_networks	pan-os	11.2
palo_alto_networks	pan-os	12.1
palo_alto_networks	pan-os	12.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a command injection vulnerability in Palo Alto Networks PAN-OS software. An authenticated administrator with CLI access can bypass system restrictions and run arbitrary commands as a root user. The vulnerability specifically affects devices configured with a Luna Hardware Security Module (HSM).

Detection Guidance

To detect this vulnerability, check if your PAN-OS device is configured with a Luna HSM and has CLI access enabled. Review administrative access logs for suspicious commands. No specific commands are provided in the context.

Impact Analysis

If exploited, an attacker with administrative CLI access could execute malicious commands with root privileges, potentially compromising the entire device. This could lead to unauthorized data access, system manipulation, or denial of service. The impact is reduced if CLI access is restricted to a limited group of administrators.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized root-level command execution on affected systems. Such access could lead to data breaches, unauthorized data access, or manipulation, which are critical violations under these regulations. The risk is heightened if CLI access is not strictly controlled.

Mitigation Strategies

Immediately restrict CLI access to a limited group of administrators. Upgrade to the latest patched versions of PAN-OS (10.2, 11.1, 11.2, 12.1, 12.2) to address the vulnerability. No workarounds are available.

Hi! I’m here to help you understand CVE-2026-0309. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70