CVE-2026-0313
Cortex XSOAR: OS Command Injection Vulnerability
Exploited
Not listed
EPSS
0.008
56.8th percentile
Discovered by
Third party
Vendor-published field
Published
Oct 14, 2026
Assigned by palo_alto
Description
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Palo Alto Networks | Cortex XSIAM | SIEM & Log Management | cna-assigner |
| Palo Alto Networks | Cortex XSOAR | SIEM & Log Management | cna-assigner |
Vendor-reported products (2)
- Palo Alto Networks · Cortex XSOAR OS Query
- Palo Alto Networks · Cortex XSIAM OS Query
Credit
Mohamed Lemine Ahmed Jidou (AegisSec)
Vendor remediation
VersionMinor VersionSuggested SolutionCortex XSOAR OS QueryUpdate to 1.0.17 or later from the Cortex XSOAR Marketplace.Cortex XSIAM OS Query Update to 1.0.17 or later from the Cortex XSOAR Marketplace.