Cloud Ngfw (Palo Alto Networks) - vulnerabilities (CVEs)

74 CVEs, 0 in the last 30 days, 10 known versions, newest CVE from 2026-09-10. Vendor: Palo Alto Networks.

CVEs of Cloud Ngfw

CVE-2026-0310 - CVSS 7.2 (high), 2026-09-10: A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network…
CVE-2026-0301 - CVSS 7.5 (high), 2026-08-13: An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network…
CVE-2026-0287 - CVSS 7.5 (high), 2026-07-09: Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of…
CVE-2025-4614 - CVSS 4.8 (medium), 2025-10-09: An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users…
CVE-2025-2182 - CVSS 5.6 (medium), 2025-08-13: A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key…
CVE-2025-4229 - CVSS 6 (medium), 2025-06-13: An information disclosure vulnerability in the SD-WAN feature of Palo Alto Networks PAN-OS® software enables an unauthorized user to view unencrypted data…
CVE-2025-4230 - CVSS 8.4 (high), 2025-06-13: A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run…
CVE-2025-4231 - CVSS 8.6 (high), 2025-06-13: A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker…
CVE-2025-0137 - CVSS 4.8 (medium), 2025-05-14: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated…
CVE-2025-0133 - CVSS 2.7 (low), 2025-05-14: A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables…
CVE-2025-0136 - CVSS 5.3 (medium), 2025-05-14: Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400…
CVE-2025-0130 - CVSS 8.2 (high), 2025-05-14: A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of…
CVE-2025-0123 - CVSS 5.9 (medium), 2025-04-11: A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature…
CVE-2025-0127 - CVSS 7.1 (high), 2025-04-11: A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run…
CVE-2025-0128 - CVSS 8.7 (high), 2025-04-11: A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software…
CVE-2025-0124 - CVSS 5.1 (medium), 2025-04-11: An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the…
CVE-2025-0126 - CVSS 8.3 (high), 2025-04-11: When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and…
CVE-2025-0125 - CVSS 6.9 (medium), 2025-04-11: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated…
CVE-2025-0114 - CVSS 8.2 (high), 2025-03-12: A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the…
CVE-2025-0116 - CVSS 6.8 (medium), 2025-03-12: A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a specially crafted…
CVE-2025-0115 - CVSS 6.8 (medium), 2025-03-12: A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attacker must have…
CVE-2025-0111 - CVSS 7.1 (high), 2025-02-12: An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web…
CVE-2025-0109 - CVSS 6.9 (medium), 2025-02-12: An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network…
CVE-2025-0108 - CVSS 9.1 (critical), 2025-02-12: An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to…
CVE-2025-0104 - CVSS 7 (high), 2025-01-11: A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of…
CVE-2025-0107 - CVSS 9.8 (critical), 2025-01-11: An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user…
CVE-2025-0103 - CVSS 9.2 (critical), 2025-01-11: An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password…
CVE-2025-0106 - CVSS 6.9 (medium), 2025-01-11: A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem.
CVE-2025-0105 - CVSS 9.1 (critical), 2025-01-11: An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the…
CVE-2024-3393 - CVSS 8.7 (high), 2024-12-27: A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious…
CVE-2024-9474 - CVSS 7.2 (high), 2024-11-18: A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to…
CVE-2024-0012 - CVSS 9.8 (critical), 2024-11-18: An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain…
CVE-2024-5920 - CVSS 4.8 (medium), 2024-11-14: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a…
CVE-2024-5919 - CVSS 6.5 (medium), 2024-11-14: A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate…
CVE-2024-9472 - CVSS 8.7 (high), 2024-11-14: A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when…
CVE-2024-5917 - CVSS 4.9 (medium), 2024-11-14: A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a…
CVE-2024-5918 - CVSS 5.3 (medium), 2024-11-14: An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate…
CVE-2024-2552 - CVSS 6.8 (medium), 2024-11-14: A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management…
CVE-2024-2551 - CVSS 8.7 (high), 2024-11-14: A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the…
CVE-2024-2550 - CVSS 8.7 (high), 2024-11-14: A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the…
CVE-2024-9471 - CVSS 5.1 (medium), 2024-10-09: A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted…
CVE-2024-9468 - CVSS 8.2 (high), 2024-10-09: A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the…
CVE-2024-8688 - CVSS 6.7 (medium), 2024-09-11: An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated…
CVE-2024-8687 - CVSS 7.1 (high), 2024-09-11: An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured…
CVE-2024-8686 - CVSS 8.6 (high), 2024-09-11: A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary…
CVE-2024-8691 - CVSS 7.1 (high), 2024-09-11: A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another…
CVE-2024-5916 - CVSS 6 (medium), 2024-08-14: An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets,…
CVE-2024-5913 - CVSS 6.8 (medium), 2024-07-10: An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system…
CVE-2024-5911 - CVSS 7 (high), 2024-07-10: An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web…
CVE-2024-3400 - CVSS 10 (critical), 2024-04-12: A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific…
CVE-2024-3386 - CVSS 5.3 (medium), 2024-04-10: An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended.…
CVE-2024-3385 - CVSS 7.5 (high), 2024-04-10: A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually…
CVE-2024-3388 - CVSS 5 (medium), 2024-04-10: A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send…
CVE-2024-3384 - CVSS 7.5 (high), 2024-04-10: A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager…
CVE-2024-3387 - CVSS 5.9 (medium), 2024-04-10: A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to…
CVE-2024-3383 - CVSS 9.1 (critical), 2024-04-10: A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID…
CVE-2024-3382 - CVSS 7.5 (high), 2024-04-10: A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually…
CVE-2024-2433 - CVSS 4.3 (medium), 2024-03-13: An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web…
CVE-2024-0007 - CVSS 6.8 (medium), 2024-02-14: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a…
CVE-2024-0010 - CVSS 6.1 (medium), 2024-02-14: A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious…
CVE-2024-0009 - CVSS 6.3 (medium), 2024-02-14: An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen…
CVE-2024-0008 - CVSS 8.8 (high), 2024-02-14: Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized…
CVE-2024-0011 - CVSS 6.1 (medium), 2024-02-14: A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious…
CVE-2023-6795 - CVSS 5.5 (medium), 2023-12-13: An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially…
CVE-2023-6794 - CVSS 5.5 (medium), 2023-12-13: An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web…
CVE-2023-6790 - CVSS 8.8 (high), 2023-12-13: A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the…
CVE-2023-6793 - CVSS 2.7 (low), 2023-12-13: An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API…
CVE-2023-6792 - CVSS 6.3 (medium), 2023-12-13: An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and…
CVE-2023-6791 - CVSS 4.9 (medium), 2023-12-13: A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext…
CVE-2023-6789 - CVSS 4.8 (medium), 2023-12-13: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a…
CVE-2023-38046 - CVSS 5.5 (medium), 2023-07-12: A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created…
CVE-2023-0010 - CVSS 5.4 (medium), 2023-06-14: A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be…
CVE-2023-0008 - CVSS 4.4 (medium), 2023-05-10: A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to…
CVE-2023-0007 - CVSS 6.5 (medium), 2023-05-10: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to…
CVE-2023-0004 - CVSS 6.5 (medium), 2023-04-12: A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system…
CVE-2023-0005 - CVSS 4.9 (medium), 2023-04-12: A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device…
CVE-2022-0030 - CVSS 8.1 (high), 2022-10-12: An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the…
CVE-2022-0028 - CVSS 8.6 (high), 2022-08-10: A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.…