Vulnerabilities
Vulnerabilities affecting firewalls and security appliances, with vendor fix data, CISA KEV status and EPSS.
Intelligence updated 30 Sept 2026 at 12:52 UTC
46 vulnerabilities
- CVE-2026-030113 Aug 2026
PAN-OS: Information Disclosure Vulnerability in URL Filtering
High7.5CVSS 3.1, High0.32% - CVE-2026-02809 Jul 2026
PAN-OS: IPv6 Firewall Policy Bypass
High7.2CVSS 3.1, High0.34% - CVE-2026-02819 Jul 2026
PAN-OS: Information Disclosure Vulnerability in Management Web Interface
High7.1CVSS 3.1, High0.28% - CVE-2026-02839 Jul 2026
PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)
High7.2CVSS 3.1, High0.38% - CVE-2026-02849 Jul 2026
PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)
Critical9.9CVSS 3.1, Critical0.47% - CVE-2026-02869 Jul 2026
PAN-OS: Authenticated Command Injection in CLI
High7.2CVSS 3.1, High2% - CVE-2026-02879 Jul 2026
PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing
High7.5CVSS 3.1, High0.62% - CVE-2026-02888 Jul 2026
PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent
High7.5CVSS 3.1, High0.83% - CVE-2026-027310 Jun 2026
PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI
High7.2CVSS 3.1, High1% - CVE-2026-027210 Jun 2026
PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI)
High7.2CVSS 3.1, High0.26% PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
Critical9.1CVSS 3.1, Critical96%- CVE-2026-025813 May 2026
PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching
Critical9.1CVSS 3.1, Critical0.33% - CVE-2026-025913 May 2026
WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B)
High8.8CVSS 3.1, High0.34% - CVE-2026-026113 May 2026
PAN-OS: Authenticated Admin Command Injection Vulnerability
High7.2CVSS 3.1, High1% - CVE-2026-026213 May 2026
PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing
High7.5CVSS 3.1, High0.36% - CVE-2026-026313 May 2026
PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing
Critical9.8CVSS 3.1, Critical0.37% - CVE-2026-026413 May 2026
PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution
Critical9.8CVSS 3.1, Critical0.47% - CVE-2026-026513 May 2026
PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled
High8.1CVSS 3.1, High1% PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
Critical9.8CVSS 3.1, Critical32%- CVE-2026-022715 Jan 2026
PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal
High7.5CVSS 3.1, High0.75% - CVE-2025-46159 Oct 2025
PAN-OS: Improper Neutralization of Input in the Management Web Interface
High7.2CVSS 3.1, High0.79% - CVE-2025-423112 Jun 2025
PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface
High7.2CVSS 3.1, High0.98% - CVE-2025-013014 May 2025
PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets
High7.5CVSS 3.1, High0.42% - CVE-2025-011412 Mar 2025
PAN-OS: Denial of Service (DoS) in GlobalProtect
High7.5CVSS 3.1, High0.41% PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
Medium6.5CVSS 3.1, Medium2%PAN-OS: Authentication Bypass in the Management Web Interface
Critical9.1CVSS 3.1, Critical98%PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet
High7.5CVSS 3.1, High28%PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
High7.2CVSS 3.1, High95%PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
Critical9.8CVSS 3.1, Critical100%- CVE-2024-255014 Nov 2024
PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet
High7.5CVSS 3.1, High0.51%