Description
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.
Published: 2026-10-14
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Command Execution
Action: Patch Now
AI Analysis

Impact

A command injection flaw in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query allows an authenticated administrator to run arbitrary OS commands on monitored endpoints. This can lead to data loss, system compromise or denial of service. The weakness is classified as CWE-78, OS Command Injection.

Affected Systems

The vulnerability affects Palo Alto Networks Cortex XSOAR OS Query and Cortex XSIAM OS Query content packs. All versions prior to 1.0.17 are vulnerable; the remedy is to upgrade to 1.0.17 or later as distributed via the Cortex XSOAR Marketplace.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, and the EPSS score is not currently available. The vulnerability is not listed in the CISA KEV catalog. Attackers must be an authenticated administrator, and they can trigger the injection through the OSQueryBasicQuery automation. Because the flaw requires valid credentials, the impact is limited to privileged accounts but remains high if such accounts are compromised.

Generated by OpenCVE AI on October 15, 2026 at 13:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Cortex XSOAR OS Query and Cortex XSIAM OS Query content packs to version 1.0.17 or later from the Cortex XSOAR Marketplace.
  • If an immediate upgrade is not feasible, disable the OSQueryBasicQuery automation in both Cortex XSOAR and Cortex XSIAM to block exploit attempts.
  • Apply least privilege to administrative accounts by restricting OSQueryBasicQuery usage to only essential users, reducing risk if an account is compromised.

Generated by OpenCVE AI on October 15, 2026 at 13:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.
Title Cortex XSOAR: OS Command Injection Vulnerability
First Time appeared Palo Alto Networks
Palo Alto Networks cortex Xsiam Os Query
Palo Alto Networks cortex Xsoar Os Query
Weaknesses CWE-78
CPEs cpe:2.3:a:palo_alto_networks:cortex_xsiam_os_query:*:*:*:*:*:*:*:*
cpe:2.3:a:palo_alto_networks:cortex_xsoar_os_query:*:*:*:*:*:*:*:*
Vendors & Products Palo Alto Networks
Palo Alto Networks cortex Xsiam Os Query
Palo Alto Networks cortex Xsoar Os Query
References
Metrics cvssV4_0

{'score': 6.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber'}

Subscriptions

Palo Alto Networks Cortex Xsiam Os Query Cortex Xsoar Os Query
cve-icon MITRE

Status: PUBLISHED

Assigner: palo_alto

Published:

Updated: 2026-10-14T20:27:19.112Z

Reserved: 2025-11-03T20:45:12.007Z

Link: CVE-2026-0313

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-14T21:17:18.173

Modified: 2026-10-14T21:17:18.173

Link: CVE-2026-0313

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-15T13:30:02Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')