Medium4.0Palo Alto Networks

Medium [CVE-2026-1723] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R

This medium-severity Palo Alto Networks advisory covers CVE-2026-1723.

CVE-2026-1723 Published Jan 30, 2026Updated by vendor Jun 17, 2026

CVE-2026-1723

Affected products & platforms

Palo Alto NetworksUnclassified

Open vendor advisory

Android app · Google Play

Monitor future Palo Alto Networks CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in TOTOLINK X6000R allows OS Command Injection. This issue affects X6000R: through V9.4.0cu.1498_B20250826.

Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings: NIST: NVD N/A NVD assessment not yet provided. CNA: Palo Alto Networks, Inc.

References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you.

No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose.

NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be me

Affected versions

through 9.4.0cu.1498_B20250826

NVD record · high-confidence parse· fetched 9 days ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

NVD record · high-confidence parse· fetched 9 days ago·verify at source

Mitigation

The source record does not include mitigation steps. That is not a statement that no fix exists — read the vendor advisory below for the authoritative guidance.

NVD record · high-confidence parse· fetched 9 days ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Palo Alto Networks Security Advisoriesofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://security.paloaltonetworks.com/rss.xml; this link opens the Palo Alto Networks advisory index instead of the raw feed document.
Palo Alto Networks
NVD discovery recordNVD
Independent discovery and scoring cross-reference. Vendor remediation guidance takes precedence.
NIST National Vulnerability Database

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-1723NVD CVE.org MITRE

Official resources

Palo Alto Networks Security Advisories portal
Official documentation
Canonical advisory portal — check here for the latest revision of this advisory and affected-version updates.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.