CVE-2024-5914 is an unauthenticated command injection in the CommonScripts pack for Palo Alto Networks Cortex XSOAR. NVD scores it 9.8 (Critical), while the vendor scores it 7.0 (High). Packs earlier than 1.12.33 are affected, and 1.12.33 and later are fixed.
What's affected
The NVD record says an unauthenticated attacker can run arbitrary commands within the context of an integration container. The weakness is CWE-77, improper neutralization of special elements in a command.
The vendor advisory states that CommonScripts packs earlier than 1.12.33 are affected and 1.12.33 and later are fixed. It also says only integrations that use the ScheduleGenericPolling or GenericPollingScheduledTask scripts are exposed.
Severity conflict. NVD gives 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Palo Alto Networks gives a CVSS-B score of 7.0 (High) with a suggested urgency of Moderate. The title uses the record, and you should read both numbers as a range. The vendor is not aware of malicious exploitation and the record does not flag the CVE as known exploited.
How to check if you're exposed
In the XSOAR marketplace or pack manager, open the installed content packs and read the version of CommonScripts. Anything below 1.12.33 needs an update.
Then check whether any playbook or integration calls ScheduleGenericPolling or GenericPollingScheduledTask. If none do, your practical exposure is lower, but the pack should still be updated.
What to do now
- Update the CommonScripts pack to 1.12.33 or later.
- If you cannot update yet, remove any integration use of the ScheduleGenericPolling and GenericPollingScheduledTask scripts, as the vendor advises.
- Review playbooks and integrations for those two script names and document where they were used.
- Check which secrets and network paths the integration containers can reach, and narrow them where you can.
- Track content pack versions the same way you track application versions.
Why it matters
Command injection happens when input is placed into a command line without being neutralized, so the receiving shell treats data as instructions. An unauthenticated path to that flaw is why NVD scores it near the maximum.
The vendor scores it lower, likely because the reachable surface is limited to specific scripts and to the integration container rather than the whole platform. Automation platforms hold credentials for many other systems, so even a container-scoped flaw deserves a prompt update. Content packs are code, and they need patching like code.
Quick check
Does every XSOAR deployment have this problem?
Only deployments with a CommonScripts pack earlier than 1.12.33, and per the vendor only integrations that use the two named polling scripts.
Is it known to be exploited?
Palo Alto Networks says it is not aware of malicious exploitation, and the CVE is not in the CISA KEV catalog per the record.
Sources
- Palo Alto Networks advisory for CVE-2024-5914
- NVD record for CVE-2024-5914
- Gold entry
Last reviewed: 19 October 2026.
