PAN-OS
CVE-2026-0309: Authenticated Command Injection in CLI with Luna HSM Configuration
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Cloud NGFW | Not affected |
| PAN-OS 12.2 | 12.2.3 or later |
| PAN-OS 12.1 | 12.1.4-h10, 12.1.7-h5, 12.1.10 or later |
| PAN-OS 11.2 | 11.2.4-h21, 11.2.7-h20, 11.2.10-h14, 11.2.13-h2 or later |
| PAN-OS 11.1 | 11.1.4-h36, 11.1.6-h38, 11.1.7-h10, 11.1.10-h33, 11.1.13-h12, 11.1.16-h2 or later |
| PAN-OS 10.2 | 10.2.7-h37, 10.2.10-h40, 10.2.13-h24, 10.2.16-h10, 10.2.18-h10 or later |
| Prisma Access | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM).
The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.
Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
Am I affected?
This issue is only applicable to PAN-OS firewalls configured with a Luna Hardware Security Module (HSM) (https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/secure-keys-with-hardware-security-module/set-up-connectivity-with-hsm-pan-os/set-up-connectivity-with-safenet-network-hsm). To check if a PAN-OS device has Luna Hardware Security Module (HSM) configured:
1. Log in to the firewall web interface. 2. Navigate to Device > Setup > HSM. 3. Check the Setup Hardware Security Module section: If HSM setting fields are displayed your device is affected.
Workarounds
No known workarounds exist for this issue.
Exploitation
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.