Palo Alto NetworksCVE-2026-0302

Palo Alto Networks Checkov by Prisma Cloud: command injection

CVE-2026-0302 · Published Sep 10, 2026

Low1.1

Fix: upgrade to 3.2.502 or later

An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov.

Affected versions

Package	Affected	Fixed in
Checkov by Prisma Cloud Product	>= 3.2.0, < 3.2.502	3.2.502

Details and references

CVSS 4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-78

More Palo Alto Networks advisories

All Palo Alto Networks

Low 2.4Sep 10

Palo Alto Networks Checkov by Prisma Cloud: code executionCVE-2026-0303fixed in 3.2.532 Medium 4.8Sep 10

Palo Alto Networks Cortex XDR Broker VM: privilege escalationCVE-2026-0304fixed in 32.0.52 High 7.2Sep 10

Palo Alto Networks Cloud NGFW: buffer overflowCVE-2026-0310fixed in 12.2.3 +4 Medium 5.8Sep 10

Palo Alto Networks Prisma: local user could bypass configured DLP policy...CVE-2026-0306fixed in 26.2 Medium 5.9Sep 10

Palo Alto Networks GlobalProtect App: privilege escalationCVE-2026-0307fixed in 6.3.3-h15 +2 Low 1.1Sep 10

Palo Alto Networks PAN-OS: cross-site scriptingCVE-2026-0308fixed in 12.1.10 +2