Palo Alto Networks
Page 2 of 4 — Palo Alto Networks CVEs from a corpus of 342, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0132 | | 2025-05-14 | A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the B… | |
CVE-2025-0130 | High | 7.5 | 2025-05-14 | A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of malic… |
CVE-2025-0129 | | 2025-04-11 | An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy… | |
CVE-2025-0123 | | 2025-04-11 | A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature… | |
CVE-2025-0119 | | 2025-04-11 | A command injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary OS commands with root privi… | |
CVE-2025-0128 | | 2025-04-11 | A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enab… | |
CVE-2025-0127 | | 2025-04-11 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary… | |
CVE-2025-0126 | | 2025-04-11 | When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and pe… | |
CVE-2025-0125 | | 2025-04-11 | An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated rea… | |
CVE-2025-0124 | Low | 3.8 | 2025-04-11 | An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management… |
CVE-2025-0122 | | 2025-04-11 | A denial-of-service (DoS) vulnerability in Palo Alto Networks Prisma® SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma… | |
CVE-2025-0121 | | 2025-04-11 | A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the… | |
CVE-2025-0120 | High | 7.0 | 2025-04-11 | A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-admini… |
CVE-2025-0118 | High | 8.0 | 2025-03-12 | A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated… |
CVE-2025-0117 | | 2025-03-12 | A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrativ… | |
CVE-2025-0116 | | 2025-03-12 | A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a specially crafted LL… | |
CVE-2025-0115 | | 2025-03-12 | A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attacker must have net… | |
CVE-2025-0114 | High | 7.5 | 2025-03-12 | A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the se… |
CVE-2025-0112 | | 2025-02-20 | A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to… | |
CVE-2025-0113 | | 2025-02-12 | A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from th… | |
CVE-2025-0111 | Medium | 6.5 | 2025-02-12 | An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web… |
CVE-2025-0110 | | 2025-02-12 | A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI reque… | |
CVE-2025-0109 | | 2025-02-12 | An unauthenticated file deletion vulnerability in the Palo Alto Networks PAN-OS management web interface enables an unauthenticated attacker with network acces… | |
CVE-2025-0108 | Critical | 9.1 | 2025-02-12 | An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to b… |
CVE-2025-0107 | Critical | 9.8 | 2025-01-11 | An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in… |
CVE-2025-0106 | Medium | 5.3 | 2025-01-11 | A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem. |
CVE-2025-0105 | Critical | 9.1 | 2025-01-11 | An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-d… |
CVE-2025-0104 | Medium | 6.1 | 2025-01-11 | A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of… |
CVE-2025-0103 | High | 8.8 | 2025-01-11 | An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hash… |
CVE-2024-3393 | High | 7.5 | 2024-12-27 | A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious pack… |
CVE-2024-5921 | High | 8.8 | 2024-11-27 | An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary serv… |
CVE-2024-9474 | High | 7.2 | 2024-11-18 | A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform… |
CVE-2024-0012 | Critical | 9.8 | 2024-11-18 | An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain… |
CVE-2024-9472 | | 2024-11-14 | A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when D… | |
CVE-2024-5920 | Medium | 4.8 | 2024-11-14 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially… |
CVE-2024-5919 | Medium | 6.5 | 2024-11-14 | A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary… |
CVE-2024-5918 | Medium | 4.3 | 2024-11-14 | An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate t… |
CVE-2024-5917 | Medium | 4.9 | 2024-11-14 | A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a… |
CVE-2024-2552 | Medium | 6.0 | 2024-11-14 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management… |
CVE-2024-2551 | High | 7.5 | 2024-11-14 | A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewal… |
CVE-2024-2550 | High | 7.5 | 2024-11-14 | A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the Glo… |
CVE-2024-9473 | High | 7.8 | 2024-10-09 | A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to e… |
CVE-2024-9471 | Medium | 4.7 | 2024-10-09 | A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted pr… |
CVE-2024-9470 | | 2024-10-09 | A vulnerability in Cortex XSOAR allows the disclosure of incident data to users who do not have the privilege to view the data. | |
CVE-2024-9469 | Medium | 5.5 | 2024-10-09 | A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to… |
CVE-2024-9468 | High | 7.5 | 2024-10-09 | A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the… |
CVE-2024-9467 | Medium | 6.1 | 2024-10-09 | A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's b… |
CVE-2024-9466 | Medium | 6.5 | 2024-10-09 | A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, pass… |
CVE-2024-9465 | Critical | 9.1 | 2024-10-09 | An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password has… |
CVE-2024-9464 | Medium | 6.5 | 2024-10-09 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, res… |
CVE-2024-9463 | High | 7.5 | 2024-10-09 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, r… |
CVE-2024-8691 | High | 7.1 | 2024-09-11 | A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another G… |
CVE-2024-8690 | Medium | 4.4 | 2024-09-11 | A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows administrator privileges to disa… |
CVE-2024-8689 | | 2024-09-11 | A problem with the ActiveMQ integration for both Cortex XSOAR and Cortex XSIAM can result in the cleartext exposure of the configured ActiveMQ credentials in l… | |
CVE-2024-8688 | Medium | 4.4 | 2024-09-11 | An improper neutralization of matching symbols vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables authenticated administrators… |
CVE-2024-8687 | High | 7.1 | 2024-09-11 | An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalPro… |
CVE-2024-8686 | High | 7.2 | 2024-09-11 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary… |
CVE-2024-5916 | Medium | 4.4 | 2024-08-14 | An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords… |
CVE-2024-5915 | High | 7.8 | 2024-08-14 | A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-5914 | Critical | 9.8 | 2024-08-14 | A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the con… |
CVE-2024-5913 | Medium | 6.1 | 2024-07-10 | An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system t… |
CVE-2024-5912 | | 2024-07-10 | An improper file signature check in Palo Alto Networks Cortex XDR agent may allow an attacker to bypass the Cortex XDR agent's executable blocking capabilities… | |
CVE-2024-5911 | Medium | 4.9 | 2024-07-10 | An arbitrary file upload vulnerability in Palo Alto Networks Panorama software enables an authenticated read-write administrator with access to the web interfa… |
CVE-2024-5910 | Critical | 9.8 | 2024-07-10 | Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network acc… |
CVE-2024-5909 | Medium | 5.5 | 2024-06-12 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the a… |
CVE-2024-5908 | High | 7.5 | 2024-06-12 | A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in applicat… |
CVE-2024-5907 | High | 7.0 | 2024-06-12 | A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-5906 | Medium | 4.8 | 2024-06-12 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for… |
CVE-2024-5905 | Medium | 4.4 | 2024-06-12 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local low privileged Windows user to disrupt some… |
CVE-2024-3400 | Critical | 10.0 | 2024-04-12 | A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS… |
CVE-2024-3388 | Medium | 4.1 | 2024-04-10 | A vulnerability in the GlobalProtect Gateway in Palo Alto Networks PAN-OS software enables an authenticated attacker to impersonate another user and send netwo… |
CVE-2024-3387 | Medium | 5.3 | 2024-04-10 | A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to ca… |
CVE-2024-3386 | Medium | 5.3 | 2024-04-10 | An incorrect string comparison vulnerability in Palo Alto Networks PAN-OS software prevents Predefined Decryption Exclusions from functioning as intended. This… |
CVE-2024-3385 | High | 7.5 | 2024-04-10 | A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually c… |
CVE-2024-3384 | High | 7.5 | 2024-04-10 | A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (N… |
CVE-2024-3383 | High | 7.4 | 2024-04-10 | A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID group… |
CVE-2024-3382 | High | 7.5 | 2024-04-10 | A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually pre… |
CVE-2024-2433 | Medium | 4.3 | 2024-03-13 | An improper authorization vulnerability in Palo Alto Networks Panorama software enables an authenticated read-only administrator to upload files using the web… |
CVE-2024-2432 | Medium | 4.5 | 2024-03-13 | A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated… |
CVE-2024-2431 | Medium | 5.5 | 2024-03-13 | An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disa… |
CVE-2024-0011 | Medium | 4.3 | 2024-02-14 | A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScr… |
CVE-2024-0010 | Medium | 4.3 | 2024-02-14 | A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious J… |
CVE-2024-0009 | Medium | 6.3 | 2024-02-14 | An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credenti… |
CVE-2024-0008 | Medium | 6.6 | 2024-02-14 | Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized acces… |
CVE-2024-0007 | Medium | 6.8 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScri… |
CVE-2023-6795 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially… |
CVE-2023-6794 | Medium | 5.5 | 2023-12-13 | An arbitrary file upload vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface… |
CVE-2023-6793 | Low | 2.7 | 2023-12-13 | An improper privilege management vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to revoke active XML API… |
CVE-2023-6792 | Medium | 5.5 | 2023-12-13 | An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and po… |
CVE-2023-6791 | Medium | 4.9 | 2023-12-13 | A credential disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-only administrator to obtain the plaintext credential… |
CVE-2023-6790 | High | 8.8 | 2023-12-13 | A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the con… |
CVE-2023-6789 | Medium | 4.3 | 2023-12-13 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a malicious authenticated read-write administrator to store a JavaScri… |
CVE-2023-3282 | Medium | 6.4 | 2023-11-08 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local atta… |
CVE-2023-3280 | Medium | 5.5 | 2023-09-13 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent. |
CVE-2023-38046 | Medium | 5.5 | 2023-07-12 | A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created co… |
CVE-2023-0010 | Medium | 5.4 | 2023-06-14 | A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be e… |
CVE-2023-0009 | High | 7.8 | 2023-06-14 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated p… |
CVE-2023-0008 | Medium | 4.4 | 2023-05-10 | A file disclosure vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write administrator with access to the web interface to exp… |
CVE-2023-0007 | Medium | 6.5 | 2023-05-10 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software on Panorama appliances enables an authenticated read-write administrator to st… |
CVE-2023-0006 | Medium | 6.3 | 2023-04-12 | A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with… |