Security1 hOctober 22, 2026, 16:20

CVE-2026-0313: OS command injection in OS Query for Cortex XSOAR and XSIAM

Palo Alto Networks disclosed CVE-2026-0313, a CWE-78 OS command injection in the OS Query content pack for Cortex XSOAR and Cortex XSIAM. An authenticated administrator can run arbitrary commands on remote endpoints via the SSH integration; versions below 1.0.17 are affected and 1.0.17 is the fix.

DEV Community

Open source

CVE-2026-0313: OS command injection in OS Query for Cortex XSOAR and XSIAM

CVSS-B 8.6, CVSS-BT 6.1; no known malicious exploitation
OS Query below 1.0.17 on Cortex XSOAR and XSIAM is affected
Exploitation requires admin credentials and a configured SSH integration
ZoomEye returned 7,667 assets matching the Cortex XSOAR fingerprint

#PaloAltoNetworks#CortexXSOAR#CortexXSIAM

Palo Alto Networks launches Cortex XCOR, AI agents that root-cause outages in minutes

Security

Ivanti brand query returns 3 assets while full product name finds 1.2 million

Security

MarkLogic privilege escalation chain reaches database admin from query access

Security

CVE-2026-0313: OS command injection in OS Query for Cortex XSOAR and XSIAM

Palo Alto Networks launches Cortex XCOR, AI agents that root-cause outages in minutes

Ivanti brand query returns 3 assets while full product name finds 1.2 million

MarkLogic privilege escalation chain reaches database admin from query access

Tornado 6.5.9 fixes three flaws: symlinks, response size, query string