Advisories
CVE-2026-0302: Local OS Command Injection in Checkov by Prisma Cloud (v3.2.0‑3.2.501)
An OS command injection flaw in Checkov by Prisma Cloud allows local users to run arbitrary commands within the Checkov process. The issue exists in versions 3.2.0 through 3.2.501 and is mitigated by upgrading to 3.2.502 or later. Defenders should audit for vulnerable installations and apply the patch immediately.
Checkov by Prisma Cloud, a Terraform IaC scanner, contains an OS command injection vulnerability (CVE‑2026‑0302) that permits a local user to execute arbitrary commands in the Checkov process.
What happened
The flaw arises from improper sanitization of user‑supplied input during scan execution, allowing injection of shell commands.
Impact
Local users with minimal privileges can gain elevated execution within the Checkov process, potentially affecting the host system if the scanner runs with elevated rights.
Severity: LOW (CVSS‑B: 4.7)
Affected versions
- Checkov by Prisma Cloud 3.2.0 through 3.2.501
Mitigation
Upgrade to version 3.2.502 or later. No workarounds are available.
What to do
- Identify installations of Checkov by Prisma Cloud.
- Verify version and apply the latest patch.
- Review scan configurations to ensure no untrusted input is passed to Checkov.
Related vulnerabilities
Cortex XSOAR XSIAM OS Query Command Injection (CVE‑2026‑0313)
A command‑injection flaw in the Cortex XSOAR and XSIAM OS Query content pack lets an authenticated admin run arbitrary OS commands on endpoints. The issue exists in OS Query 1.0.17 and earlier when the SSH integration is enabled. Upgrade to 1.0.17+ or disable the automation to mitigate.
Read briefing
CISA Adds Zimbra OS Command Injection CVE‑2026‑73570 to KEV Catalog
CISA has just added CVE‑2026‑73570, an OS command injection vulnerability in Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities (KEV) list after confirmed active exploitation. Federal agencies are now required to patch this flaw immediately under BOD 26‑04, while all organizations are urged to adopt a risk‑based remediation strategy. The KEV catalog will expand as more exploited CVEs surface, and entities can nominate new entries via CISA’s KEV Nomination Form.
Read briefing
CVE-2026-0305: Information Disclosure in Palo Alto Networks Prisma Access Agent on Linux
A local user can read sensitive configuration files and credentials from the Prisma Access Agent running on Linux. The flaw exists in versions 24.0 through 26.2.2 and is mitigated by upgrading to 26.3 or later. Defenders should audit Linux hosts for the affected agent and apply the update promptly.
Read briefing
Dual Critical Flaws in Ivanti Sentry Enable Unauthenticated RCE and Admin Account Creation
CERT‑EU has exposed two zero‑day weaknesses in Ivanti Sentry appliances. CVE‑2026‑10520 is an OS command injection that can be leveraged for root‑level remote code execution, while CVE‑2026‑10523 allows attackers to bypass authentication and create arbitrary administrative accounts. All Sentry releases up to 10.7.0 are affected. Immediate patching is required to avoid exploitation.
Read briefing