High8.6Vendor: MediumPalo Alto Networks

High [CVE-2026-0261] PAN-OS: Authenticated Admin Command Injection Vulnerability

This high-severity Palo Alto Networks advisory covers CVE-2026-0261 affecting PAN-OS.

CVE-2026-0261 Published May 28, 2026

CVE-2026-0261

Affected products & platforms

Palo Alto NetworksPAN-OSFirewallPAN-OS / Panorama

Open vendor advisory

Android app · Google Play

Monitor future Palo Alto Networks CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

CVE-2026-0261 PAN-OS: Authenticated Admin Command Injection Vulnerability

Affected versions

PAN-OS 12.1: < 12.1.4-h5< 12.1.7
PAN-OS 11.2: < 11.2.4-h17< 11.2.7-h13< 11.2.10-h6< 11.2.12
PAN-OS 11.1: < 11.1.4-h33< 11.1.6-h32< 11.1.7-h6< 11.1.10-h25< 11.1.13-h5< 11.1.15
PAN-OS 10.2: < 10.2.7-h34< 10.2.10-h36< 10.2.13-h21< 10.2.16-h7< 10.2.18-h6

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

PAN-OS >= 12.1.7
PAN-OS >= 12.1.4-h5
PAN-OS >= 11.2.12
PAN-OS >= 11.2.10-h6
PAN-OS >= 11.2.7-h13
PAN-OS >= 11.2.4-h17
PAN-OS >= 11.1.15
PAN-OS >= 11.1.13-h5
PAN-OS >= 11.1.10-h25
PAN-OS >= 11.1.7-h6
PAN-OS >= 11.1.6-h32
PAN-OS >= 11.1.4-h33
PAN-OS >= 10.2.18-h6
PAN-OS >= 10.2.16-h7
PAN-OS >= 10.2.13-h21
PAN-OS >= 10.2.10-h36
PAN-OS >= 10.2.7-h34

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation checklist

Recommended fix / mitigation

VersionMinor VersionSuggested SolutionCloud NGFWNo action needed.
PAN-OS 12.1 12.1.5 through 12.1.6 Upgrade to 12.1.7 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h5 or 12.1.7 or later.

Temporary workarounds

The vast majority of firewalls already follow Palo Alto Networks' and industry best practices.
However, if you have not already, we strongly recommend that you secure access to your management interface according to our best practice deployment guidelines.
Specifically, you should restrict management interface access to only trusted internal IP addresses.
Review information about how to secure management access to your Palo Alto Networks firewalls:
For these Threat IDs to protect against attacks for this vulnerability:

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Palo Alto Networks Security Advisoriesofficial
Official vendor feed — the source of truth for this advisory. VulniPulse polled this feed and parsed this entry from it. Discovered from the machine-readable feed https://security.paloaltonetworks.com/rss.xml; this link opens the Palo Alto Networks advisory index instead of the raw feed document.
Palo Alto Networks
Vendor advisory pageofficial
Advisory page fetched and parsed to extract affected/fixed versions and mitigation guidance beyond what the feed carries.
Palo Alto Networks
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-0261NVD CVE.org MITRE

Official resources

PAN-OS / Panorama upgrade guide (target: 12.1.7 / 12.1.4-h5 / 11.2.12)
Official documentation
This advisory names 12.1.7 / 12.1.4-h5 / 11.2.12 as the first fixed releases — official upgrade documentation for PAN-OS firewalls and Panorama.
Palo Alto Networks Security Advisories portal
Official documentation
Canonical advisory portal — check here for the latest revision of this advisory and affected-version updates.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.