CVE-2026-0273Disclosure(paloaltonetworks / pan-os)

MEDIUMCVSS 7.2 · HIGH

Exploitation observed; activity peaked at 4 mentions and remains active

Immediate actions

Patch paloaltonetworks pan-os systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

paloaltonetworks CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://security.paloaltonetworks.com/CVE-2026-0273

Other references

https://cert-portal.siemens.com/productcert/html/ssa-104023.html

Weakness type (CWE)

CWE-78

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

pan-os

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
6 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 3 signals
Technical details provided in 6 signals
Disclosure: 3 classified signals
Peaked 2d ago at 4 mentions (2026-06-12); latest day: 1
6 total mentions across 3 days

Affected systems

Vendors

paloaltonetworks

Products

pan-os

18 versions affected across 1 product

Deep dive

Activity timeline6 mentions / 3d

Signal classification3 categories

Disclosure

350.0%

Patch

233.3%

Active Exploitation

116.7%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-12	4	Active Exploitation1Disclosure1Patch2
2026-06-19	1	Disclosure1
2026-07-21	1	Disclosure1

Full discourse6 posts

Cyber Security News@The_Cyber_News137d
Disclosure
⚠️ Palo Alto PAN-OS Flaw Allows Attackers to Execute Arbitrary Commands as Root User Source: https://cybersecuritynews.com/palo-alto-pan-os-vulnerability/ Palo Alto Networks fixed a new command injection vulnerability in PAN‑OS (CVE-2026-0273) that allows authenticated administrators to execute arbitrary commands as root via the CLI or web management interface. Two related medium‑severity issues in the same advisory window cover CLI privilege escalation (CVE‑2026‑0272) and a tunnel traffic denial‑of‑service bug (CVE‑2026‑0269). CVE‑2026‑0273 affects PA‑Series and VM‑Series firewalls as well as Panorama appliances running specific PAN‑OS 12.1, 11.2, 11.1 and 10.2 versions. #cybersecuritynews
Post summary
Palo Alto Networks disclosed a command‑injection flaw (CVE‑2026‑0273) that lets authenticated admins run arbitrary commands as root via the CLI or web interface, and the vendor has released a fix.
329096237.4K
69.8K followersView on X
iototsecnews@iototsecnews130d
Disclosure
Palo Alto PAN-OS の脆弱性 CVE-2026-0273／0272／0269 が FIX：root 権限での任意のコマンドなど https://iototsecnews.jp/2026/06/12/palo-alto-pan-os-vulnerability-allows-attackers-to-execute-arbitrary-commands-as-root-user/ Palo Alto Networks の PAN-OS に見つかった、3 件の脆弱性について解説する記事です。不適切な入力処理により制限が回避され、root 権限で任意のコマンドを実行されてしまう CVE-2026-0273 や、 CLIにおける権限昇格の不具合である CVE-2026-0272 が存在します。また、トンネル・トラフィック処理におけるメモリ破損 CVE-2026-0269 が原因で、デバイスが繰り返し再起動してしまう問題も含まれています。ご利用のチームは、ご注意ください。 #CVE20260269 #CVE20260272 #CVE20260273 #PaloAlto #PANOS #Vulnerability
Post summary
The post explains that Palo Alto Networks’ PAN‑OS is affected by three CVEs—CVE‑2026‑0273 and ‑0272 allow privilege escalation to run arbitrary commands as root, while CVE‑2026‑0269 causes memory corruption and repeated reboots.
01000160
499 followersView on X
Windows Forum@windowsforum97d
Disclosure
⚠️ Every RUGGEDCOM APE1808 running Palo Alto’s virtual firewall is exposed—including a flaw letting authenticated admins run root commands. In OT, “admin access” shouldn’t mean “own the box.” https://windowsforum.com/threads/cve-2026-0273-lets-admins-run-root-commands-on-siemens-ape1808.439868/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #IndustrialCybersecurity #OtSecurity #SiemensRuggedcom https://t.co/ugM9nMubov
Post summary
The post discloses CVE‑2026‑0273, a privilege escalation flaw in RuggedCom APE1808 running Palo Alto’s virtual firewall that permits authenticated administrators to execute commands with root privileges.
0000012
1.3K followersView on X
The Daily Tech Feed@dailytechonx136d
Patch
Palo Alto Networks has patched a critical PAN-OS vulnerability (CVE-2026-0273) that allows authenticated administrators to execute commands as root. Affected versions include 12.1, 11.2, 11.1, and 10.2. Organizations should apply the patches promptly to mitigate risks. #PaloAlto #PANOS #CyberSecurity #Vulnerability #CVE20260273 #NetworkSecurity https://thedailytechfeed.com/palo-alto-pan-os-vulnerability-allows-root-command-execution/
Post summary
Palo Alto Networks announced a patch for CVE-2026-0273, a critical PAN-OS vulnerability that lets authenticated admins run commands as root; the article urges organizations to apply the patch without evidence of active exploitation.
0000039
389 followersView on X
Kaitan ID Security@KaitanSecurity136d
Active Exploitation
⚠️ HIGH — CVE-2026-0273 PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI (Severity: MEDIUM) CVSS 6.1 | EPSS 0.00 (49th pctl) ⚡ Exploit in the wild Full analysis → https://sec.kaitan.id/cves/CVE-2026-0273 #PaloAlto #CyberSecurity #InfoSec
Post summary
CVE-2026-0273, an authenticated admin command injection vulnerability in PAN-OS, is being exploited in the wild, as evidenced by the "Exploit in the wild" claim, but the post does not provide PoC or exploit code details.
0000037
81 followersView on X
Israel@f1tym1137d
Patch
Palo Alto PAN-OS Vulnerability Allows Attackers to Execute Arbitrary Commands as Root User https://ift.tt/ZlqYheT Palo Alto Networks fixed a new command injection vulnerability in PAN‑OS (CVE-2026-0273) that allows authenticated administrators to execute arbitrary commands as…
Post summary
Palo Alto Networks released a patch for CVE‑2026‑0273, a command injection flaw that could let authenticated admins execute arbitrary root‑level commands. No active exploitation or PoC details are reported.
0000033
996 followersView on X

CPE platform detail177 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

177 of 177 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	paloaltonetworks	pan-os	-	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.10	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.13	-	-
OS	paloaltonetworks	pan-os	10.2.16	-	-
OS	paloaltonetworks	pan-os	10.2.16	-	-
OS	paloaltonetworks	pan-os	10.2.16	-	-
OS	paloaltonetworks	pan-os	10.2.16	-	-
OS	paloaltonetworks	pan-os	10.2.16	-	-
OS	paloaltonetworks	pan-os	10.2.17	-	-
OS	paloaltonetworks	pan-os	10.2.18	-	-
OS	paloaltonetworks	pan-os	10.2.18	-	-
OS	paloaltonetworks	pan-os	10.2.18	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	10.2.7	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.10	-	-
OS	paloaltonetworks	pan-os	11.1.13	-	-
OS	paloaltonetworks	pan-os	11.1.13	-	-
OS	paloaltonetworks	pan-os	11.1.13	-	-
OS	paloaltonetworks	pan-os	11.1.13	-	-
OS	paloaltonetworks	pan-os	11.1.13	-	-
OS	paloaltonetworks	pan-os	11.1.13	-	-
OS	paloaltonetworks	pan-os	11.1.14	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.4	-	-
OS	paloaltonetworks	pan-os	11.1.5	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.6	-	-
OS	paloaltonetworks	pan-os	11.1.7	-	-
OS	paloaltonetworks	pan-os	11.1.7	-	-
OS	paloaltonetworks	pan-os	11.1.7	-	-
OS	paloaltonetworks	pan-os	11.1.7	-	-
OS	paloaltonetworks	pan-os	11.1.7	-	-
OS	paloaltonetworks	pan-os	11.2.10	-	-
OS	paloaltonetworks	pan-os	11.2.10	-	-
OS	paloaltonetworks	pan-os	11.2.10	-	-
OS	paloaltonetworks	pan-os	11.2.10	-	-
OS	paloaltonetworks	pan-os	11.2.10	-	-
OS	paloaltonetworks	pan-os	11.2.10	-	-
OS	paloaltonetworks	pan-os	11.2.10	-	-
OS	paloaltonetworks	pan-os	11.2.10	-	-
OS	paloaltonetworks	pan-os	11.2.10	-	-
OS	paloaltonetworks	pan-os	11.2.11	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.4	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	11.2.7	-	-
OS	paloaltonetworks	pan-os	12.1.4	-	-
OS	paloaltonetworks	pan-os	12.1.4	-	-
OS	paloaltonetworks	pan-os	12.1.4	-	-
OS	paloaltonetworks	pan-os	12.1.4	-	-
OS	paloaltonetworks	pan-os	12.1.4	-	-

Explore more

Back to dashboard paloaltonetworks CVEs pan-os vulnerabilities

What researchers are saying

CVE-2026-0273

Cyber Security News[verified]@The_Cyber_NewsDisclosure

Palo Alto Networks disclosed a command‑injection flaw (CVE‑2026‑0273) that lets authenticated admins run arbitrary commands as root via the CLI or web interface, and the vendor has released a fix.

Windows Forum[verified]@windowsforumDisclosure

The post discloses CVE‑2026‑0273, a privilege escalation flaw in RuggedCom APE1808 running Palo Alto’s virtual firewall that permits authenticated administrators to execute commands with root privileges.

The Daily Tech Feed[verified]@dailytechonxPatch

Palo Alto Networks announced a patch for CVE-2026-0273, a critical PAN-OS vulnerability that lets authenticated admins run commands as root; the article urges organizations to apply the patch without evidence of active exploitation.

Kaitan ID Security[verified]@KaitanSecurityActive Exploitation

CVE-2026-0273, an authenticated admin command injection vulnerability in PAN-OS, is being exploited in the wild, as evidenced by the "Exploit in the wild" claim, but the post does not provide PoC or exploit code details.

Israel[verified]@f1tym1Patch

Palo Alto Networks released a patch for CVE‑2026‑0273, a command injection flaw that could let authenticated admins execute arbitrary root‑level commands. No active exploitation or PoC details are reported.

iototsecnews@iototsecnewsDisclosure

The post explains that Palo Alto Networks’ PAN‑OS is affected by three CVEs—CVE‑2026‑0273 and ‑0272 allow privilege escalation to run arbitrary commands as root, while CVE‑2026‑0269 causes memory corruption and repeated reboots.