vulnerability

Palo Alto Networks PAN-OS: CVE-2023-6792: PAN-OS: OS Command Injection Vulnerability in the XML API

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:M/C:C/I:P/A:N)

Published

Dec 13, 2023

Added

Jan 7, 2025

Modified

Mar 25, 2026

Description

An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

Solution

palo-alto-networks-pan-os-upgrade-latest

References

CWE-88
CWE-78
CVE-2023-6792
https://attackerkb.com/topics/CVE-2023-6792
https://security.paloaltonetworks.com/CVE-2023-6792
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59003

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report