[ Vendor · 28 CVEs ]
Palo Alto Networks
CVEs affecting Palo Alto Networks published in the last 30 days, plus any Palo Alto Networks CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-45165 | 15 Oct 2026 | CVSS 8.6 | Palo Alto Networks Idira Secrets Manager (Self-Hosted)An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy… | |
| CVE-2026-0320 | 14 Oct 2026 | CVSS 6.1 | Palo Alto Networks Cloud NGFWA command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run… | |
| CVE-2026-0318 | 14 Oct 2026 | CVSS 4.6 | Palo Alto Networks Cloud NGFWA stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an… | |
| CVE-2026-0319 | 14 Oct 2026 | CVSS 4.9 | Palo Alto Networks Cloud NGFWAn improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to… | |
| CVE-2026-0312 | 14 Oct 2026 | CVSS 4.3 | Palo Alto Networks Checkov by Prisma CloudPath traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary… | |
| CVE-2026-0313 | 14 Oct 2026 | CVSS 6.1 | Palo Alto Networks Cortex XSOAR OS QueryA command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to… | |
| CVE-2026-0314 | 14 Oct 2026 | CVSS 4.3 | Palo Alto Networks GlobalProtect AppA type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of… | |
| CVE-2026-0315 | 14 Oct 2026 | CVSS 5.9 | Palo Alto Networks GlobalProtect AppA local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on… | |
| CVE-2026-0316 | 14 Oct 2026 | CVSS 1.1 | Palo Alto Networks Cloud NGFWA stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or… | |
| CVE-2026-0317 | 14 Oct 2026 | CVSS 1.2 | Palo Alto Networks Cloud NGFWA denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a… | |
| CVE-2026-0311 | 14 Oct 2026 | CVSS 1.1 | Palo Alto Networks Checkov by Prisma CloudA server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized… | |
| CVE-2026-0321 | 14 Oct 2026 | CVSS 6.6 | Palo Alto Networks Cloud NGFWDenial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of… | |
| CVE-2026-0322 | 14 Oct 2026 | CVSS 7.2 | Code injection in PAN-OS management interface gives root on firewallsA remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with… | Exploited |
| CVE-2026-0257 | 13 May 2026 | CVSS 9.1 | Palo Alto Networks PAN-OS Authentication BypassAuthentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass… | Exploited |
| CVE-2026-0300 | 6 May 2026 | CVSS 9.8 | Palo Alto Networks PAN-OS Out-of-bounds WriteA buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an… | Exploited |
| CVE-2025-0108 | 12 Feb 2025 | CVSS 9.1 | Palo Alto Networks PAN-OS Authentication BypassAn authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web… | Exploited |
| CVE-2025-0111 | 12 Feb 2025 | CVSS 6.5 | Palo Alto Networks PAN-OS File ReadAn authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the… | Exploited |
| CVE-2024-3393 | 27 Dec 2024 | CVSS 7.5 | Palo Alto Networks PAN-OS Malicious DNS PacketA Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a… | Exploited |
| CVE-2024-9474 | 18 Nov 2024 | CVSS 7.2 | Palo Alto Networks PAN-OS Management Interface OS Command InjectionA privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface… | Exploited |
| CVE-2024-0012 | 18 Nov 2024 | CVSS 9.8 | Palo Alto Networks PAN-OS Management Interface Authentication BypassAn authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web… | Exploited |
| CVE-2024-9465 | 9 Oct 2024 | CVSS 9.1 | Palo Alto Networks Expedition SQL InjectionAn SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as… | Exploited |
| CVE-2024-9463 | 9 Oct 2024 | CVSS 7.5 | Palo Alto Networks Expedition OS Command InjectionAn OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in… | Exploited |
| CVE-2024-5910 | 10 Jul 2024 | CVSS 9.8 | Palo Alto Networks Expedition Missing AuthenticationMissing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with… | Exploited |
| CVE-2024-3400 | 12 Apr 2024 | CVSS 10.0 | Palo Alto Networks PAN-OS Command InjectionA command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for… | Exploited |
| CVE-2022-0028 | 10 Aug 2022 | CVSS 8.6 | Palo Alto Networks PAN-OS Reflected Amplification Denial-of-ServiceA PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS)… | Exploited |
| CVE-2020-2021 | 29 Jun 2020 | CVSS 10.0 | Palo Alto Networks PAN-OS Authentication BypassWhen Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled… | Exploited |
| CVE-2019-1579 | 19 Jul 2019 | CVSS 8.1 | Palo Alto Networks PAN-OS Remote Code ExecutionRemote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or… | Exploited |
| CVE-2017-15944 | 11 Dec 2017 | CVSS 9.8 | Palo Alto Networks PAN-OS Remote Code ExecutionPalo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute… | Exploited |