Anatomy of CVE-2026-0313: How an OS Query Becomes a Remote Shell

Command injection advisories often read as a single sentence: input was not neutralised, so an attacker ran commands. That summary hides the interesting part. In CVE-2026-0313 the injection point sits inside a legitimate feature whose entire purpose is to execute instructions on a remote machine, which is why the flaw escalates so cleanly from console access to endpoint shell.

Vulnerability overview

CVE-2026-0313 was published by Palo Alto Networks on 14 October 2026 and is catalogued as CWE-78, OS command injection. The affected artefact is the OS Query content pack for Cortex XSOAR and Cortex XSIAM. An authenticated administrator can execute arbitrary operating system commands on remote endpoints. Vendor scoring is 6.1 CVSS-BT and 8.6 CVSS-B, urgency moderate, exploit maturity unreported, with no known malicious exploitation. CERT-FR advisory CERTFR-2026-AVI-1326 includes the entry.

Mechanism and exploitation conditions

To understand the flaw, follow the data path. An administrator issues a query through the pack's interface. The pack, which exists to reach endpoints, forwards that query through the SSH integration to the remote host and asks the host shell to run it. Because the input is not properly neutralised before it reaches the command layer, the boundary between the query text and the surrounding command is not enforced.

That is the classic injection shape: a single string is assembled from user-controlled fragments and then handed to a shell that treats those fragments as syntax. In a web form the result might be an unexpected command appended to a status request. Here the shell is already remote and already privileged to run operating system commands, so the injected fragment inherits the integration's reach.

Preconditions are explicit in the advisory. The attacker needs authenticated administrative access to the Cortex instance. The OS Query pack must be installed. The SSH integration must be configured so that the pack has endpoints to talk to. Each precondition is a control point: identity proofing and least privilege for the first, removal or upgrade for the second, and credential scoping plus network segmentation for the third.

Impact

Impact is best described as a privilege translation. Administrative rights in an orchestration console are normally interpreted as authority over workflows and data. This flaw converts those rights into execution on hosts the platform manages. If the SSH integration authenticates as a low-privilege service account, the attacker gains a non-privileged shell per endpoint. If it authenticates as a local administrator or a domain account with broad rights, the injection becomes a route to estate-wide control, limited only by which endpoints the integration can reach and what the credential is allowed to do there.

Affected products and scope

The vulnerable versions are Cortex XSIAM OS Query below 1.0.17 and Cortex XSOAR OS Query below 1.0.17, with 1.0.17 as the fix on each platform. Since the pack is optional, scope is a function of deployment: pack installed plus SSH integration configured. Tenants without the pack, or with the integration removed, cannot be reached through this path.

Exposure context

External measurement is context, not scope. A ZoomEye Search dork title="Cortex XSOAR" returned 7,667 assets, viewable at https://www.zoomeye.ai/searchResult?q=dGl0bGU9IkNvcnRleCBYU09BUiI%3D. The CVE-specific Filter vul.cve="CVE-2026-0313" returned zero. Read precisely, 7,667 counts product-fingerprinted assets and says nothing about content pack presence or integration state, and zero means the CVE is not represented in fingerprint data. Neither number replaces a configuration inventory.

Remediation and mitigations

Upgrade the OS Query content pack to 1.0.17 on both platforms. If the upgrade cannot be completed immediately, break the exploitation chain: disable the SSH integration or restrict it to a dedicated account with the minimum rights needed for read-only querying, and deny the integration egress to endpoints outside the intended scope.

For engineers reviewing similar components, three habits pay off. First, treat any feature whose purpose is remote execution as security-sensitive code, regardless of whether it ships as a platform release or a content pack. Second, keep the identity used by an integration distinct from human administrative accounts, so that console-level compromise does not automatically carry host-level rights. Third, log both sides of the boundary: the platform's record of what query was requested and the endpoint's record of what process actually started. When the two disagree, that gap is where an injection lives.