An authenticated administrator who can reach the PAN‑OS management interface may exploit a command‑injection flaw that bypasses system restrictions and executes arbitrary commands as root. The vulnerability is classified as CWE‑78. Because execution is restricted to users with administrative credentials, the primary risk is privilege escalation and unauthorized system control rather than arbitrary command execution by unauthenticated users. If successful, the attacker can compromise the integrity and availability of the firewall, potentially redirecting traffic, disabling security policies, or performing further lateral movement.

Palo Alto Networks PA‑Series, VM‑Series, Panorama (cloud‑based and virtual), and M‑Series firewalls running PAN‑OS are affected. Cloud NGFW and Prisma Access environments are not impacted. Affected PAN‑OS versions include 12.2.0 through 12.2.3, 12.1.8 through 12.1.10‑h*, 11.2.14 through 11.2.15, 11.1.14 through 11.1.16‑h*, 10.2.17 through 10.2.18‑h*, and older releases as listed in the advisory.

The CVSS score of 5.7 indicates moderate severity. The exploitation requires valid administrative credentials and access to the management interface, but once achieved it provides full root access to the device. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not currently in the CISA KEV catalog. Attackers would need to compromise credentials or exploit insider access to reach the interface; otherwise the risk is lower. Nevertheless, the potential impact justifies immediate remediation, especially in environments where management access is exposed to the broader network.