/
← Voltar ao feed
medium

Palo Alto Networks Cortex XSOAR/XSIAM OS Query content pack command injection (CVE-2026-0313) allows authenticated admin RCE

1 fonte(s) · 1 atualização(ões) · publicado 14/10/2026 13:00 · coletado há 3 dias

Palo Alto Networks disclosed CVE-2026-0313, an OS command injection vulnerability (CWE-78) in the OS Query content pack for Cortex XSOAR and Cortex XSIAM. An authenticated administrator can execute arbitrary OS commands on remote endpoints. The vendor rates it MEDIUM with MODERATE suggested urgency (CVSS-BT 6.1 / CVSS-B 8.6) and states it is not aware of any malicious exploitation.

Detalhes técnicos

  • Exposure requires both the OS Query content pack and the SSH integration to be installed and configured.
  • Attack vector is network-based, low complexity, and requires high privileges (administrator). CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H.
  • Affected: OS Query content pack versions from 1.0.0 up to (excluding) 1.0.17, for both Cortex XSOAR and Cortex XSIAM.
  • Weakness classes: CWE-78, CAPEC-88.

Remediação

  • Upgrade the OS Query content pack to version 1.0.17 or later.
  • Workaround: disable the OSQueryBasicQuery automation in Cortex XSOAR or Cortex XSIAM if immediate upgrade is not possible.

Linha do tempo

  1. security.paloaltonetworks.com ↗ · pub. 14/10/2026 13:00 · coletado 20/10 16:32 primeiro registro

    Palo Alto Networks Cortex XSOAR/XSIAM OS Query content pack command injection (CVE-2026-0313) allows authenticated admin RCE

    ler a análise desta fonte

    Palo Alto Networks disclosed CVE-2026-0313, an OS command injection vulnerability (CWE-78) in the OS Query content pack for Cortex XSOAR and Cortex XSIAM. An authenticated administrator can execute arbitrary OS commands on remote endpoints. The vendor rates it MEDIUM with MODERATE suggested urgency (CVSS-BT 6.1 / CVSS-B 8.6) and states it is not aware of any malicious exploitation.

    Technical Details

    • Exposure requires both the OS Query content pack and the SSH integration to be installed and configured.
    • Attack vector is network-based, low complexity, and requires high privileges (administrator). CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H.
    • Affected: OS Query content pack versions from 1.0.0 up to (excluding) 1.0.17, for both Cortex XSOAR and Cortex XSIAM.
    • Weakness classes: CWE-78, CAPEC-88.

    Remediation

    • Upgrade the OS Query content pack to version 1.0.17 or later.
    • Workaround: disable the OSQueryBasicQuery automation in Cortex XSOAR or Cortex XSIAM if immediate upgrade is not possible.