Pan-os (Paloaltonetworks) - vulnerabilities (CVEs)

249 CVEs, 3 in the last 30 days, 993 known versions, newest CVE from 2026-10-21. Vendor: Paloaltonetworks.

CVEs of Pan-os

CVE-2026-109619 - CVSS 9.2 (critical), 2026-10-21: PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated…
CVE-2026-109618 - CVSS 9.8 (critical), 2026-10-21: PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for…
CVE-2026-0322 - CVSS 8.6 (high), 2026-10-14: A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network…
CVE-2026-0301 - CVSS 7.5 (high), 2026-08-13: An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network…
CVE-2026-0279 - CVSS 6.1 (medium), 2026-07-09: Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and…
CVE-2026-0280 - CVSS 7.2 (high), 2026-07-09: An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall…
CVE-2026-0281 - CVSS 7.1 (high), 2026-07-09: An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web…
CVE-2026-0282 - CVSS 6.5 (medium), 2026-07-09: A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface…
CVE-2026-0283 - CVSS 7.2 (high), 2026-07-09: An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access…
CVE-2026-0284 - CVSS 9.9 (critical), 2026-07-09: An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with…
CVE-2026-0285 - CVSS 4.9 (medium), 2026-07-09: A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the…
CVE-2026-0286 - CVSS 7.2 (high), 2026-07-09: A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary…
CVE-2026-0287 - CVSS 7.5 (high), 2026-07-09: Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of…
CVE-2026-0288 - CVSS 7.5 (high), 2026-07-08: Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated…
CVE-2026-0273 - CVSS 7.2 (high), 2026-06-10: A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run…
CVE-2026-0272 - CVSS 7.2 (high), 2026-06-10: A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface…
CVE-2026-0269 - CVSS 5.7 (medium), 2026-06-10: A memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to initiate system…
CVE-2026-0266 - CVSS 4.8 (medium), 2026-06-10: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript…
CVE-2026-0262 - CVSS 7.5 (high), 2026-05-13: Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of…
CVE-2026-0261 - CVSS 7.2 (high), 2026-05-13: Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run…
CVE-2026-0259 - CVSS 8.8 (high), 2026-05-13: An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and…
CVE-2026-0258 - CVSS 9.1 (critical), 2026-05-13: A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to…
CVE-2026-0257 - CVSS 9.1 (critical), 2026-05-13: Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security…
CVE-2026-0256 - CVSS 4.8 (medium), 2026-05-13: A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript…
CVE-2026-0263 - CVSS 9.8 (critical), 2026-05-13: A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute…
CVE-2026-0265 - CVSS 8.1 (high), 2026-05-13: An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication…
CVE-2026-0264 - CVSS 9.8 (critical), 2026-05-13: A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with…
CVE-2026-0300 - CVSS 9.8 (critical), 2026-05-06: A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an…
CVE-2026-0227 - CVSS 7.5 (high), 2026-01-15: A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated…
CVE-2025-4614 - CVSS 4.8 (medium), 2025-10-09: An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users…
CVE-2025-4615 - CVSS 7.2 (high), 2025-10-09: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated…
CVE-2025-4231 - CVSS 8.6 (high), 2025-06-13: A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker…
CVE-2025-0137 - CVSS 4.8 (medium), 2025-05-14: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated…
CVE-2025-0136 - CVSS 5.3 (medium), 2025-05-14: Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400…
CVE-2025-0130 - CVSS 8.2 (high), 2025-05-14: A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of…
CVE-2025-0123 - CVSS 5.9 (medium), 2025-04-11: A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature…
CVE-2025-0128 - CVSS 8.7 (high), 2025-04-11: A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software…
CVE-2025-0127 - CVSS 7.1 (high), 2025-04-11: A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run…
CVE-2025-0125 - CVSS 6.9 (medium), 2025-04-11: An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated…
CVE-2025-0124 - CVSS 5.1 (medium), 2025-04-11: An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the…
CVE-2025-0126 - CVSS 8.3 (high), 2025-04-11: When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and…
CVE-2025-0115 - CVSS 6.8 (medium), 2025-03-12: A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attacker must have…
CVE-2025-0114 - CVSS 8.2 (high), 2025-03-12: A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the…
CVE-2025-0116 - CVSS 6.8 (medium), 2025-03-12: A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a specially crafted…
CVE-2025-0108 - CVSS 9.1 (critical), 2025-02-12: An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to…
CVE-2025-0111 - CVSS 7.1 (high), 2025-02-12: An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web…
CVE-2025-0109 - CVSS 6.9 (medium), 2025-02-12: An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network…
CVE-2024-3393 - CVSS 8.7 (high), 2024-12-27: A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious…
CVE-2024-9474 - CVSS 7.2 (high), 2024-11-18: A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to…
CVE-2024-0012 - CVSS 9.8 (critical), 2024-11-18: An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain…
CVE-2024-5919 - CVSS 6.5 (medium), 2024-11-14: A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate…
CVE-2024-9472 - CVSS 8.7 (high), 2024-11-14: A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when…
CVE-2024-5920 - CVSS 4.8 (medium), 2024-11-14: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a…
CVE-2024-5917 - CVSS 4.9 (medium), 2024-11-14: A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a…
CVE-2024-5918 - CVSS 5.3 (medium), 2024-11-14: An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate…
CVE-2024-2551 - CVSS 8.7 (high), 2024-11-14: A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the…
CVE-2024-2550 - CVSS 8.7 (high), 2024-11-14: A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the…
CVE-2024-2552 - CVSS 6.8 (medium), 2024-11-14: A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management…
CVE-2024-9471 - CVSS 5.1 (medium), 2024-10-09: A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted…
CVE-2024-9468 - CVSS 8.2 (high), 2024-10-09: A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the…
CVE-2024-8691 - CVSS 7.1 (high), 2024-09-11: A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another…
CVE-2024-8688 - CVSS 6.7 (medium), 2024-09-11: An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated…
CVE-2024-8687 - CVSS 7.1 (high), 2024-09-11: An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured…
CVE-2024-8686 - CVSS 8.6 (high), 2024-09-11: A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary…
CVE-2024-5916 - CVSS 6 (medium), 2024-08-14: An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets,…
CVE-2024-5913 - CVSS 6.8 (medium), 2024-07-10: An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system…
CVE-2024-5911 - CVSS 7 (high), 2024-07-10: An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web…
CVE-2024-3400 - CVSS 10 (critical), 2024-04-12: A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific…
CVE-2024-3383 - CVSS 9.1 (critical), 2024-04-10: A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID…
CVE-2024-3386 - CVSS 5.3 (medium), 2024-04-10: An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended.…
CVE-2024-3385 - CVSS 7.5 (high), 2024-04-10: A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually…
CVE-2024-3388 - CVSS 5 (medium), 2024-04-10: A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send…
CVE-2024-3384 - CVSS 7.5 (high), 2024-04-10: A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager…
CVE-2024-3387 - CVSS 5.9 (medium), 2024-04-10: A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to…
CVE-2024-3382 - CVSS 7.5 (high), 2024-04-10: A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually…
CVE-2024-2433 - CVSS 4.3 (medium), 2024-03-13: An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web…
CVE-2024-0011 - CVSS 6.1 (medium), 2024-02-14: A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious…
CVE-2024-0007 - CVSS 6.8 (medium), 2024-02-14: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a…
CVE-2024-0010 - CVSS 6.1 (medium), 2024-02-14: A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious…
CVE-2024-0009 - CVSS 6.3 (medium), 2024-02-14: An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen…
CVE-2024-0008 - CVSS 8.8 (high), 2024-02-14: Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized…
CVE-2023-6795 - CVSS 5.5 (medium), 2023-12-13: An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially…
CVE-2023-6794 - CVSS 5.5 (medium), 2023-12-13: An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web…
CVE-2023-6790 - CVSS 8.8 (high), 2023-12-13: A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the…
CVE-2023-6793 - CVSS 2.7 (low), 2023-12-13: An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API…
CVE-2023-6792 - CVSS 6.3 (medium), 2023-12-13: An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and…
CVE-2023-6791 - CVSS 4.9 (medium), 2023-12-13: A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext…
CVE-2023-6789 - CVSS 4.8 (medium), 2023-12-13: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a…
CVE-2023-38046 - CVSS 5.5 (medium), 2023-07-12: A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created…
CVE-2023-0010 - CVSS 5.4 (medium), 2023-06-14: A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be…
CVE-2023-0008 - CVSS 4.4 (medium), 2023-05-10: A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to…
CVE-2023-0007 - CVSS 6.5 (medium), 2023-05-10: A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to…
CVE-2023-0005 - CVSS 4.9 (medium), 2023-04-12: A vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to expose the plaintext values of secrets stored in the device…
CVE-2023-0004 - CVSS 6.5 (medium), 2023-04-12: A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system…
CVE-2022-0030 - CVSS 8.1 (high), 2022-10-12: An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the…
CVE-2022-0028 - CVSS 8.6 (high), 2022-08-10: A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.…
CVE-2022-0024 - CVSS 7.2 (high), 2022-05-11: A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created…
CVE-2022-0023 - CVSS 5.9 (medium), 2022-04-13: An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a…
CVE-2022-0022 - CVSS 4.4 (medium), 2022-03-09: Usage of a weak cryptographic algorithm in Palo Alto Networks PAN-OS software where the password hashes of administrator and local user accounts are not…
CVE-2022-0011 - CVSS 6.5 (medium), 2022-02-10: PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your…