High8.5Vendor: MediumPalo Alto Networks

High [CVE-2026-0286] PAN-OS: Authenticated Command Injection in CLI

This high-severity Palo Alto Networks advisory covers CVE-2026-0286 affecting PAN-OS.

CVE-2026-0286 Published Jul 8, 2026

CVE-2026-0286

Affected products & platforms

Palo Alto NetworksPAN-OSFirewallPAN-OS / Panorama

Open vendor advisory

Android app · Google Play

Monitor future Palo Alto Networks CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

CVE-2026-0286 PAN-OS: Authenticated Command Injection in CLI

Affected versions

PAN-OS < 12.1.8
PAN-OS < 11.2.13
PAN-OS < 11.1.16
PAN-OS < 10.2.18-h8

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Fixed versions

PAN-OS >= 12.1.8
PAN-OS >= 12.1.7-h2
PAN-OS >= 12.1.4-h8
PAN-OS >= 11.2.13
PAN-OS >= 11.2.10-h11
PAN-OS >= 11.2.7-h18
PAN-OS >= 11.2.4-h20
PAN-OS >= 11.1.16
PAN-OS >= 11.1.13-h9
PAN-OS >= 11.1.10-h30
PAN-OS >= 11.1.7-h8
PAN-OS >= 11.1.6-h35
PAN-OS >= 11.1.4-h35
PAN-OS >= 10.2.18-h8
PAN-OS >= 10.2.16-h9
PAN-OS >= 10.2.13-h23
PAN-OS >= 10.2.10-h39
PAN-OS >= 10.2.7-h36

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

VersionMinor VersionSuggested SolutionCloud NGFW AllNo action needed.
PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later.

Temporary workarounds

Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510036 (from Applications and Threats content version 9122-10145 and later).
For these Threat IDs to protect against attacks for this vulnerability:
Route incoming traffic for the MGT port through a DP port, e.g., enabling management profile on a DP interface for management access.Replace the Certificate for Inbound Traffic Management.
Decrypt inbound traffic to the management interface so the firewall can inspect it.Enable threat prevention on the inbound traffic to management services.
Please note that this Threat ID requires SSL Decryption.

Official advisory · high-confidence parse· fetched 8 days ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Palo Alto Networks Security Advisoriesofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://security.paloaltonetworks.com/rss.xml; this link opens the Palo Alto Networks advisory index instead of the raw feed document.
Palo Alto Networks
Official vendor advisoryofficial
Official advisory page fetched and parsed; accepted detail fields are attributed to this page.
Palo Alto Networks
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-0286NVD CVE.org MITRE

Official resources

PAN-OS / Panorama upgrade guide (target: 12.1.8 / 12.1.7-h2 / 12.1.4-h8)
Official documentation
This advisory names 12.1.8 / 12.1.7-h2 / 12.1.4-h8 as the first fixed releases — official upgrade documentation for PAN-OS firewalls and Panorama.
Prisma Access / Prisma documentation
Official documentation
Official Prisma product documentation for the affected component.
Palo Alto Networks Security Advisories portal
Official documentation
Canonical advisory portal — check here for the latest revision of this advisory and affected-version updates.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.