CVE-2026-0313CWE-78command-injection

CVE-2026-0313

published October 15, 2026

CVSS
6.1
EPSS
1%
Percentile
57.2
In the wild
Unconfirmed
What it is

A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.

The record
Technical detail
CVSS
6.1 · NONE
CVSS v4.0
6.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
EPSS
0.00833 · 57.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-10-15T01:17Z
References (1)
https://security.paloaltonetworks.com/CVE-2026-0313 · [email protected]
EPSS history
Timeline
  • 16 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 14 OCT 20:27Z
    Cortex XSOAR: OS Command Injection Vulnerability
    cvelistv5
  • 14 OCT 20:27Z
    Cortex XSOAR: OS Command Injection Vulnerability
    cvelistv5