CVE-2026-0313: Cortex XSOAR: OS Command Injection Vulnerability (Severity: MEDIUM)
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.17 - Upgrade
Upgrade
Cortex XSOAR and Cortex XSIAM OS Query content packto a version that resolves this vulnerability.Fixed in 1.0.17 - Configuration
Disable the OSQueryBasicQuery automation until the OS Query content pack is upgraded.
Cortex XSOAR or Cortex XSIAM OSQueryBasicQuery automation = disabled
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Organizations using the Palo Alto Networks Cortex XSOAR OS Query content pack or the Palo Alto Networks Cortex XSIAM OS Query content pack are affected. Exploitation targets remote endpoints through the vulnerable content pack.
What access does an attacker need to exploit it?
An attacker must be authenticated as an administrator. No user interaction is required, and the attack can be performed over the network.
What is the potential impact of successful exploitation?
A successful attacker can execute arbitrary operating-system commands on remote endpoints. This can compromise the confidentiality, integrity, and availability of the affected endpoints.