Paloaltonetworks
71 CVEs across 125 Paloaltonetworks products. Browse Paloaltonetworks vulnerabilities, severities, and proof-of-concept exploits.
Paloaltonetworks products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0278 | High | 7.8 | 2026-07-09 | Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enfo… |
CVE-2026-0277 | Medium | 5.9 | 2026-07-09 | An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) attack to interc… |
CVE-2026-0276 | High | 7.8 | 2026-07-09 | A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user. |
CVE-2026-0275 | Medium | 6.7 | 2026-07-09 | A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local fi… |
CVE-2026-0287 | High | 7.5 | 2026-07-09 | Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of se… |
CVE-2026-0286 | High | 7.2 | 2026-07-09 | A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS… |
CVE-2026-0285 | Medium | 4.9 | 2026-07-09 | A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the mana… |
CVE-2026-0284 | Critical | 9.9 | 2026-07-09 | An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with net… |
CVE-2026-0283 | High | 7.2 | 2026-07-09 | An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access t… |
CVE-2026-0282 | Medium | 6.5 | 2026-07-09 | A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to… |
CVE-2026-0281 | High | 7.1 | 2026-07-09 | An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web in… |
CVE-2026-0280 | High | 7.2 | 2026-07-09 | An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security… |
CVE-2026-0279 | Medium | 6.1 | 2026-07-09 | Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Cl… |
CVE-2026-0288 | High | 7.5 | 2026-07-08 | Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated at… |
CVE-2026-45169 | High | 8.6 | 2026-06-12 | Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific… |
CVE-2026-45170 | High | 8.8 | 2026-06-12 | Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be… |
CVE-2026-45174 | High | 7.8 | 2026-06-11 | Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization. CyberArk… |
CVE-2026-45173 | Medium | 6.5 | 2026-06-11 | Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw within its internal web-page ver… |
CVE-2026-45172 | High | 8.8 | 2026-06-11 | Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, l… |
CVE-2026-45171 | High | 8.8 | 2026-06-11 | Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5… |
CVE-2026-45175 | High | 7.8 | 2026-06-11 | Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation processes. A local attacker coul… |
CVE-2026-45178 | High | 8.1 | 2026-06-11 | Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints. A remote, authenticated attacker… |
CVE-2026-45177 | Critical | 9.1 | 2026-06-11 | Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated… |
CVE-2026-45176 | High | 7.8 | 2026-06-11 | Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components. A local, low-privileged… |
CVE-2026-0274 | Critical | 9.1 | 2026-06-10 | An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker… |
CVE-2026-0273 | High | 7.2 | 2026-06-10 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary… |
CVE-2026-0272 | High | 7.2 | 2026-06-10 | A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CL… |
CVE-2026-0271 | High | 7.8 | 2026-06-10 | A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux devices enables a local user to execute code with elevated… |
CVE-2026-0270 | High | 7.5 | 2026-06-10 | A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network… |
CVE-2026-0269 | Medium | 5.7 | 2026-06-10 | A memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to initiate system re… |
CVE-2026-0268 | Medium | 4.4 | 2026-06-10 | A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel. This does… |
CVE-2026-0267 | Medium | 5.5 | 2026-06-10 | An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling… |
CVE-2026-0266 | Medium | 4.8 | 2026-06-10 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload… |
CVE-2026-0243 | Medium | 6.5 | 2026-05-13 | A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma S… |
CVE-2026-0262 | High | 7.5 | 2026-05-13 | Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of se… |
CVE-2026-0261 | High | 7.2 | 2026-05-13 | Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run a… |
CVE-2026-0259 | High | 8.8 | 2026-05-13 | An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and… |
CVE-2026-0258 | Critical | 9.1 | 2026-05-13 | A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cau… |
CVE-2026-0257 | Critical | 9.1 | 2026-05-13 | Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security res… |
CVE-2026-0256 | Medium | 4.8 | 2026-05-13 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript… |
CVE-2026-0251 | High | 7.8 | 2026-05-13 | Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORIT… |
CVE-2026-0250 | High | 8.1 | 2026-05-13 | A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and p… |
CVE-2026-0249 | Medium | 6.5 | 2026-05-13 | Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications… |
CVE-2026-0248 | Medium | 5.9 | 2026-05-13 | An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM… |
CVE-2026-0247 | High | 7.8 | 2026-05-13 | Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls an… |
CVE-2026-0246 | High | 7.8 | 2026-05-13 | A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to… |
CVE-2026-0245 | Medium | 5.5 | 2026-05-13 | Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials. The Prism… |
CVE-2026-0244 | High | 8.1 | 2026-05-13 | An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the contr… |
CVE-2026-0241 | High | 7.2 | 2026-05-13 | Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted… |
CVE-2026-0240 | High | 8.7 | 2026-05-13 | An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vaul… |
CVE-2026-0239 | Medium | 6.5 | 2026-05-13 | An information disclosure vulnerability in the Chronosphere Chronocollector enables an unauthenticated attacker with network access to the collector service to… |
CVE-2026-0238 | Low | 3.2 | 2026-05-13 | A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fields. |
CVE-2026-0236 | High | 7.8 | 2026-05-13 | A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally… |
CVE-2026-0235 | Medium | 4.7 | 2026-05-13 | A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access and data control p… |
CVE-2026-0265 | High | 8.1 | 2026-05-13 | An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication… |
CVE-2026-0264 | Critical | 9.8 | 2026-05-13 | A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network… |
CVE-2026-0263 | Critical | 9.8 | 2026-05-13 | A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbi… |
CVE-2026-0237 | High | 7.8 | 2026-05-13 | An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automati… |
CVE-2026-0300 | Critical | 9.8 | 2026-05-06 | A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthentica… |
CVE-2026-0234 | Critical | 9.1 | 2026-04-13 | An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that… |
CVE-2026-0233 | High | 8.8 | 2026-04-13 | A certificate validation vulnerability in Palo Alto Networks Autonomous Digital Experience Manager on Windows allows an unauthenticated attacker with adjacent… |
CVE-2026-0232 | Medium | 4.4 | 2026-04-13 | A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows allows a local Windows administrator to disable the agent. This iss… |
CVE-2026-0227 | High | 7.5 | 2026-01-15 | A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts… |
CVE-2025-4615 | High | 7.2 | 2025-10-09 | An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrato… |
CVE-2025-4614 | Low | 2.7 | 2025-10-09 | An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authentic… |
CVE-2025-4227 | Low | 3.5 | 2025-06-13 | An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-… |
CVE-2025-4232 | High | 8.8 | 2025-06-13 | An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrati… |
CVE-2025-4231 | High | 7.2 | 2025-06-13 | A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker… |
CVE-2025-0135 | Low | 3.3 | 2025-05-14 | An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrativ… |
CVE-2025-0130 | High | 7.5 | 2025-05-14 | A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of malic… |
CVE-2025-0124 | Low | 3.8 | 2025-04-11 | An authenticated file deletion vulnerability in the Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to the management… |
CVE-2025-0120 | High | 7.0 | 2025-04-11 | A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-admini… |
CVE-2025-0118 | High | 8.0 | 2025-03-12 | A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated… |
CVE-2025-0114 | High | 7.5 | 2025-03-12 | A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the se… |
CVE-2025-0111 | Medium | 6.5 | 2025-02-12 | An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web… |
CVE-2025-0108 | Critical | 9.1 | 2025-02-12 | An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to b… |
CVE-2025-0107 | Critical | 9.8 | 2025-01-11 | An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in… |
CVE-2025-0106 | Medium | 5.3 | 2025-01-11 | A wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem. |
CVE-2025-0105 | Critical | 9.1 | 2025-01-11 | An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-d… |
CVE-2025-0104 | Medium | 6.1 | 2025-01-11 | A reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of… |
CVE-2025-0103 | High | 8.8 | 2025-01-11 | An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hash… |
CVE-2024-3393 | High | 7.5 | 2024-12-27 | A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious pack… |
CVE-2024-5921 | High | 8.8 | 2024-11-27 | An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary serv… |
CVE-2024-9474 | High | 7.2 | 2024-11-18 | A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform… |
CVE-2024-0012 | Critical | 9.8 | 2024-11-18 | An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain… |
CVE-2024-5920 | Medium | 4.8 | 2024-11-14 | A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially… |
CVE-2024-5919 | Medium | 6.5 | 2024-11-14 | A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary… |
CVE-2024-5918 | Medium | 4.3 | 2024-11-14 | An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate t… |
CVE-2024-5917 | Medium | 4.9 | 2024-11-14 | A server-side request forgery in PAN-OS software enables an authenticated attacker with administrative privileges to use the administrative web interface as a… |
CVE-2024-2552 | Medium | 6.0 | 2024-11-14 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management… |
CVE-2024-2551 | High | 7.5 | 2024-11-14 | A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewal… |
CVE-2024-2550 | High | 7.5 | 2024-11-14 | A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the Glo… |
CVE-2024-9473 | High | 7.8 | 2024-10-09 | A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to e… |
CVE-2024-9471 | Medium | 4.7 | 2024-10-09 | A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted pr… |
CVE-2024-9469 | Medium | 5.5 | 2024-10-09 | A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to… |
CVE-2024-9468 | High | 7.5 | 2024-10-09 | A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the… |
CVE-2024-9467 | Medium | 6.1 | 2024-10-09 | A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's b… |
CVE-2024-9466 | Medium | 6.5 | 2024-10-09 | A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, pass… |
CVE-2024-9465 | Critical | 9.1 | 2024-10-09 | An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password has… |
CVE-2024-9464 | Medium | 6.5 | 2024-10-09 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, res… |