Cortex XSOAR and XSIAM Users Urged to Update to 1.0.17 to Fix Admin Command Injection
An authenticated administrator can run arbitrary OS commands via a flaw in the OS Query content pack for Cortex XSOAR and XSIAM platforms.
Key points
- CVE-2026-0313 allows arbitrary OS command execution on remote endpoints.
- The flaw affects Cortex XSOAR and XSIAM versions 1.0.0 through 1.0.16.
- Palo Alto Networks released version 1.0.17 to resolve the issue.
Palo Alto Networks has issued a patch for a medium-severity command injection vulnerability identified as CVE-2026-0313. The flaw exists in the OS Query content pack used within Cortex XSOAR and Cortex XSIAM security platforms. This update allows administrators to remediate a risk that could lead to unauthorized operating system command execution on connected endpoints.
The vulnerability enables an authenticated administrator to execute arbitrary OS commands on remote endpoints. According to the official advisory, this issue requires both the OS Query content pack and the SSH integration to be installed and configured. The CVSS base score is 8.6, while the base threat score is 6.1, reflecting the high privilege requirement for exploitation.
Context and Background
Palo Alto Networks stated it is not aware of any malicious exploitation of this issue in the wild. The company assigned a moderate suggested urgency to the advisory. This incident follows other recent disclosures involving Palo Alto products, such as a medium-severity command injection in PAN-OS addressed in October 2026, as Threat Times reported on that date.
The flaw is classified under CWE-78, which covers improper neutralization of special elements used in an OS command. It affects the Cortex XSOAR OS Query and Cortex XSIAM OS Query components. The vendor has released version 1.0.17 to address the improper input handling that allows command injection.
Who Is Affected
The vulnerability impacts users of Cortex XSOAR and Cortex XSIAM who have installed the OS Query content pack. Specifically, versions 1.0.0 through 1.0.16 are vulnerable. The flaw does not affect systems that lack the OS Query content pack or the required SSH integration. Administrators with access to these platforms are the only users capable of triggering the exploit.
What should you do?
Palo Alto Networks advises customers to update to version 1.0.17 or later from the Cortex XSOAR Marketplace. For those unable to upgrade immediately, the vendor recommends disabling the OSQueryBasicQuery automation in Cortex XSOAR or Cortex XSIAM. This mitigation step removes the functionality that exposes the command injection vector until a full update can be applied.
What to do and how to stay safe: Palo Alto Networks
- Verify if the OS Query content pack and SSH integration are installed on your Cortex XSOAR or XSIAM instances.
- Check the current version of the OS Query pack; if it is below 1.0.17, plan an immediate update.
- If you cannot patch right away, disable the OSQueryBasicQuery automation to mitigate the risk.
- Monitor official vendor advisories for further details on exploitation or additional patches.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-0313?
It is a medium-severity OS command injection vulnerability in Palo Alto Networks Cortex XSOAR and XSIAM OS Query packs.
Who can exploit this vulnerability?
An authenticated administrator with access to the platform can exploit it if the OS Query pack and SSH integration are configured.
How can I fix this issue?
Update the OS Query content pack to version 1.0.17 or later, or disable the OSQueryBasicQuery automation as a temporary mitigation.
