The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute arbitrary OS commands via an unspecified API call.
Palo Alto PAN-OS 11.x | Palo Alto PAN-OS (PA-Series/VM-Series/Panorama)
Exploit
CVE-2016-3655
NVD
Refer to CVE-2016-3655 NVD advisory