CVE-2026-0313 and the Blast Radius of a Content Pack: Rethinking XSOAR Trust Boundaries

Security orchestration platforms sit in an awkward architectural position. They are management-plane tools that hold credentials for, and reach into, almost everything else. CVE-2026-0313 makes that position concrete: a content pack bug became a path from an administrative console session to an operating system shell on remote endpoints.

Vulnerability overview

Palo Alto Networks disclosed CVE-2026-0313 on 14 October 2026. It is an OS command injection, CWE-78, in the OS Query content pack for Cortex XSOAR and Cortex XSIAM. The advisory states that an authenticated administrator can execute arbitrary OS commands on remote endpoints, scores the issue 6.1 CVSS-BT and 8.6 CVSS-B, marks urgency moderate, and records exploit maturity as unreported with no known malicious use. CERT-FR lists it in advisory CERTFR-2026-AVI-1326.

Mechanism and exploitation conditions

The OS Query pack performs operating system queries against fleet endpoints and depends on the SSH integration to do so. Input supplied through the platform is not neutralised before reaching the command layer, which lets an administrator craft input that executes on the endpoint instead of being handled as a query parameter. Exploitation requires three things simultaneously: an authenticated administrative session, the pack installed, and the SSH integration configured with reachable endpoints. Remove any one and this CVE has no path.

Impact

The architectural point is that the boundary between the orchestration platform and the managed estate is only as strong as the weakest integration that crosses it. A SOAR administrator is normally assumed to be able to run playbooks, read incident data and act on alerts. This flaw extends that authority to arbitrary host commands, which is a different class of power. Once an attacker holds a shell on an endpoint, the SSH integration's credential becomes the pivot: its privilege level defines whether the breach stops at one host or reaches a wider fleet.

Affected products and scope

The affected components are Cortex XSIAM OS Query below 1.0.17 and Cortex XSOAR OS Query below 1.0.17, with 1.0.17 fixing both. Scope depends on both installation and integration state, which means architecture review should ask two questions per tenant: is the pack installed, and what identity does the SSH integration use to reach endpoints?

Exposure context

ZoomEye shows a large installed base with limited CVE-level visibility. The Search dork title="Cortex XSOAR" returned 7,667 assets, reproducible via https://www.zoomeye.ai/searchResult?q=dGl0bGU9IkNvcnRleCBYU09BUiI%3D, while vul.cve="CVE-2026-0313" returned zero. The first number is a fingerprint count of product-titled assets and cannot be read as a count of vulnerable instances; the second reflects missing CVE fingerprints, not immunity. Architecture decisions should rest on internal configuration data.

Remediation and mitigations

Upgrade the OS Query pack to 1.0.17. Beyond the fix, reduce the blast radius the flaw exposed. Segment management interfaces so that only administrative networks reach the Cortex console, which raises the bar for the credential-dependent first step. Provision SSH integration accounts as dedicated, low-privilege identities with command allow-lists where the integration supports them, and never reuse a domain administrator account for automation reach.

Inventory every integration that crosses from the management plane into the endpoint estate, and record for each: the credential identity, the privilege level, the network path, and the business owner. Treat content packs as code under review, since they execute with the privileges of the platform. Where multiple tenants exist, apply the same review to each, because a lab or regional tenant with the pack installed is as exploitable as the primary one.

One design habit is worth adopting regardless of this CVE: assume any integration credential will eventually be exercised by someone other than its intended user. If that assumption makes an integration unacceptable, the integration is over-privileged. The upgrade fixes the bug; the boundary review fixes the reason the bug mattered.

References

• Palo Alto Networks security advisory for CVE-2026-0313: https://security.paloaltonetworks.com/CVE-2026-0313
• CERT-FR advisory CERTFR-2026-AVI-1326: https://cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1326/
• CVE record: https://www.cve.org/CVERecord?id=CVE-2026-0313