CVE-2026-0313: Building Detection Coverage for the Cortex OS Query Command Injection

On October 14, 2026, Palo Alto Networks disclosed a vulnerability (CVE-2026-0313) affecting the Cortex OS Query content pack within their XSOAR and XSIAM platforms. This command injection flaw allows authenticated administrators to execute arbitrary operating system commands on remote endpoints.

The core issue lies in the improper neutralisation of special elements in OS commands (CWE-78). The vulnerability is rated 6.1 on CVSS-BT and 8.6 on CVSS-B, with moderate urgency and unreported exploit maturity. The affected component is the OS Query content pack, not the core platform, which requires installation and configuration alongside the SSH integration.

Exploitation hinges on three conditions: administrative access to the Cortex instance, a configured OS Query pack, and an SSH integration that permits reachable endpoints. Without platform credentials, an attacker cannot exploit this flaw, and without reachable integration, there is no delivery path.

The impact is a privilege pivot, allowing administrative rights to execute commands on remote endpoints, bypassing the platform's bounds. This escalation could lead to full administrative control of the estate, depending on the privileges of the SSH integration account.

Affected builds are OS Query versions below 1.0.17 for both Cortex XSOAR and Cortex XSIAM. Remediation involves upgrading to version 1.0.17 or later. However, environments with the pack installed but no SSH integration configured face a narrower exposure, though unpatched vulnerabilities remain a concern.