Vulnerabilities
Cortex XSOAR XSIAM OS Query Command Injection (CVE‑2026‑0313)
A command‑injection flaw in the Cortex XSOAR and XSIAM OS Query content pack lets an authenticated admin run arbitrary OS commands on endpoints. The issue exists in OS Query 1.0.17 and earlier when the SSH integration is enabled. Upgrade to 1.0.17+ or disable the automation to mitigate.
What happened
A command‑injection flaw (CWE‑78) was found in the OS Query content pack for Cortex XSOAR and Cortex XSIAM. When the pack and the SSH integration are installed, an authenticated administrator can trigger arbitrary OS commands on remote endpoints.
Severity: Medium (CVSS 8.6)
Impact
The vulnerability can compromise product confidentiality, integrity, and availability. An attacker with admin rights could gain full control over the target machine, potentially exfiltrating data or installing malware.
Affected Versions
- Cortex XSOAR OS Query 1.0.0‑1.0.16
- Cortex XSIAM OS Query 1.0.0‑1.0.16
Mitigation
Upgrade the OS Query content pack to 1.0.17 or later from the Marketplace. If an upgrade is not immediately possible, disable the OSQueryBasicQuery automation to block the injection vector.
Next Steps
Verify the current OS Query version, apply the update, and confirm that the SSH integration is still required. Monitor for any anomalous command execution logs.
Related vulnerabilities
CVE-2026-0302: Local OS Command Injection in Checkov by Prisma Cloud (v3.2.0‑3.2.501)
An OS command injection flaw in Checkov by Prisma Cloud allows local users to run arbitrary commands within the Checkov process. The issue exists in versions 3.2.0 through 3.2.501 and is mitigated by upgrading to 3.2.502 or later. Defenders should audit for vulnerable installations and apply the patch immediately.
Read briefing
CVE-2026-69370: Visual Studio Code Remote Code Execution via Command Injection
A command injection flaw in Visual Studio Code enables attackers to execute arbitrary code remotely. All versions that accept untrusted input in the command execution path are affected. Defenders should apply the latest update and audit remote access settings.
Read briefing
Cisco ISE invokeScript Command Injection Enables Remote Code Execution (CVE‑2026‑20147)
Cisco Identity Services Engine (ISE) is vulnerable to a command‑injection flaw that allows authenticated attackers to execute arbitrary code as the iseadminportal user. The CVE‑2026‑20147 advisory recommends applying the vendor patch immediately and tightening administrative access.
Read briefing
CISA Adds Zimbra OS Command Injection CVE‑2026‑73570 to KEV Catalog
CISA has just added CVE‑2026‑73570, an OS command injection vulnerability in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities (KEV) list after confirmed active exploitation. Federal agencies are now required to patch this flaw immediately under BOD 26‑04, while all organizations are urged to adopt a risk‑based remediation strategy. The KEV catalog will expand as more exploited CVEs surface, and entities can nominate new entries via CISA’s KEV Nomination Form.
Read briefing