Skip to content
Patcharo

Palo Alto Networks

PAN-OS vulnerabilities (CVE): affected branches, fixed releases, CISA KEV

Affected branches, fixed releases stated by the vendor and known exploitation for Palo Alto Networks PAN-OS.

Sources last modified 24 Sept 2026 · Last verified by Patcharo: 1 Oct 2026 at 13:37 UTC

42
CVEs tracked
11
Critical
10
CISA KEV
41
With a fixed release

Versions by branch

Per branch: the newest release the vendor lists, what the vendor recommends and for whom, the support state and when Patcharo last verified each fact. Three facts read from the vendor's documents and shown apart: the newest release is not a recommendation.

The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

Filter the branches

24 branches shown

  1. 12.2Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportSupported · until 30 Jul 2029
    Vulnerabilities0 CVEs
  2. 12.1Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportSupported · until 28 Aug 2028
    Vulnerabilities18 CVEs · 2 KEVnewest fix 12.1.8
  3. 11.2Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportApproaching end of support · until 2 May 2027
    Vulnerabilities26 CVEs · 7 KEVnewest fix 11.2.13
  4. 11.1Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportApproaching end of support · until 3 May 2027
    Vulnerabilities30 CVEs · 8 KEVnewest fix 11.1.16-h1
  5. 11.0Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 17 Nov 2024
    Vulnerabilities13 CVEs · 3 KEVnewest fix 11.0.6-h1
  6. 10.2Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 27 Aug 2025
    Vulnerabilities36 CVEs · 9 KEVnewest fix 10.2.18-h8
  7. 10.1Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 1 Dec 2024
    Vulnerabilities14 CVEs · 5 KEVnewest fix 10.1.15
  8. 10.0Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 16 Jul 2022
    Vulnerabilities4 CVEs · 1 KEVnewest fix 10.0.13
  9. 9.1Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 30 Jun 2024
    Vulnerabilities7 CVEs · 2 KEVnewest fix 9.1.17
  10. 9.0Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 1 Mar 2022
    Vulnerabilities6 CVEs · 2 KEVnewest fix 9.0.18
  11. 8.1Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 1 Mar 2022
    Vulnerabilities4 CVEs · 2 KEVnewest fix 8.1.25
  12. 8.0Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 31 Oct 2019
    Vulnerabilities1 CVE · 1 KEV
  13. 7.1Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 30 Jun 2020
    Vulnerabilities0 CVEs
  14. 7.0Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 4 Dec 2017
    Vulnerabilities0 CVEs
  15. 6.1Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 25 Oct 2018
    Vulnerabilities0 CVEs
  16. 6.0Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 19 Mar 2017
    Vulnerabilities0 CVEs
  17. 5.0Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 13 Nov 2016
    Vulnerabilities0 CVEs
  18. 4.1Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 30 Apr 2015
    Vulnerabilities0 CVEs
  19. 4.0Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 31 Dec 2014
    Vulnerabilities0 CVEs
  20. 3.1Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 30 Jun 2013
    Vulnerabilities0 CVEs
  21. 3.0Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 17 Dec 2010
    Vulnerabilities0 CVEs
  22. 2.1Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 5 Jan 2012
    Vulnerabilities0 CVEs
  23. 2.0Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 20 May 2009
    Vulnerabilities0 CVEs
  24. 1.3Not collected
    Latest public release

    No release listed in the sources Patcharo reads

    Vendor recommendation

    The vendor publishes its release guidance in its customer portal, which Patcharo does not read: nothing here is a recommendation.

    SupportEnd of life · until 20 Nov 2008
    Vulnerabilities0 CVEs

Last successful check against the source. The content may be unchanged. Checked about every 6 hours (192 hours for a branch past its support); “page verified recently” means a successful check within the last 24 hours. Availability, recommendation and support are read from the vendor's documents and shown apart; a release Patcharo lists is not advice to install it.

Vulnerability history

Every CVE NVD attaches to PAN-OS over the period, whatever its score: published records only, rejected identifiers kept apart. Counts are publication counts.

Ten-year view

Last 12 months · 14 Nov 2025 – 14 Nov 2026 · Rolling calendar period, by publication date of the CVE record; both days included.

The history could not be read right now. The list below shows the analysed catalog only.

Verified history · History not collected yet: the counts above are not a measure.

Scores and statuses are the facts known today, not their history.

CVEs published over the period

14 Nov 2025 – 14 Nov 2026 · Newest first. A record analysed by Patcharo links to its page with affected and fixed releases; the others show NVD's facts.

The history could not be read right now. The list below shows the analysed catalog only.

Analysed vulnerabilities

  1. CVE-2026-0301Published:

    PAN-OS: Information Disclosure Vulnerability in URL Filtering

    Palo Alto Networks PAN-OS, Palo Alto Networks Cloud NGFW, Palo Alto Networks Prisma Access

    High7.5CVSS 3.1, HighEPSS0.32%
  2. CVE-2026-0280Published:

    PAN-OS: IPv6 Firewall Policy Bypass

    Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access

    High7.2CVSS 3.1, HighEPSS0.34%
  3. CVE-2026-0281Published:

    PAN-OS: Information Disclosure Vulnerability in Management Web Interface

    Palo Alto Networks PAN-OS

    High7.1CVSS 3.1, HighEPSS0.28%
  4. CVE-2026-0283Published:

    PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS0.38%
  5. CVE-2026-0284Published:

    PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)

    Palo Alto Networks PAN-OS

    Critical9.9CVSS 3.1, CriticalEPSS0.47%
  6. CVE-2026-0286Published:

    PAN-OS: Authenticated Command Injection in CLI

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS2%
  7. CVE-2026-0287Published:

    PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing

    Palo Alto Networks PAN-OS, Palo Alto Networks Cloud NGFW, Palo Alto Networks Prisma Access

    High7.5CVSS 3.1, HighEPSS0.62%
  8. CVE-2026-0288Published:

    PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent

    Palo Alto Networks PAN-OS, Palo Alto Networks Cloud NGFW, Palo Alto Networks Prisma Access

    High7.5CVSS 3.1, HighEPSS0.83%
  9. CVE-2026-0273Published:

    PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS1%
  10. CVE-2026-0272Published:

    PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI)

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS0.26%
  11. CVE-2026-0257Published:

    PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

    Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access

    Critical9.1CVSS 3.1, CriticalKEVRansomwareDue 1 Jun 2026EPSS96%
  12. CVE-2026-0258Published:

    PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching

    Palo Alto Networks PAN-OS

    Critical9.1CVSS 3.1, CriticalEPSS0.33%
  13. CVE-2026-0261Published:

    PAN-OS: Authenticated Admin Command Injection Vulnerability

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS1%
  14. CVE-2026-0262Published:

    PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing

    Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access

    High7.5CVSS 3.1, HighEPSS0.36%
  15. CVE-2026-0263Published:

    PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing

    Palo Alto Networks PAN-OS

    Critical9.8CVSS 3.1, CriticalEPSS0.37%
  16. CVE-2026-0264Published:

    PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution

    Palo Alto Networks PAN-OS

    Critical9.8CVSS 3.1, CriticalEPSS0.47%
  17. CVE-2026-0265Published:

    PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled

    Palo Alto Networks PAN-OS

    High8.1CVSS 3.1, HighEPSS1%
  18. CVE-2026-0300Published:

    PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

    Palo Alto Networks PAN-OS

    Critical9.8CVSS 3.1, CriticalKEVDue 9 May 2026EPSS32%
  19. CVE-2026-0227Published:

    PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal

    Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access

    High7.5CVSS 3.1, HighEPSS0.75%
  20. CVE-2025-4615Published:

    PAN-OS: Improper Neutralization of Input in the Management Web Interface

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS0.79%
  21. CVE-2025-4231Published:

    PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS0.98%
  22. CVE-2025-0130Published:

    PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets

    Palo Alto Networks PAN-OS

    High7.5CVSS 3.1, HighEPSS0.42%
  23. CVE-2025-0114Published:

    PAN-OS: Denial of Service (DoS) in GlobalProtect

    Palo Alto Networks PAN-OS

    High7.5CVSS 3.1, HighEPSS0.41%
  24. CVE-2025-0111Published:

    PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface

    Palo Alto Networks PAN-OS

    Medium6.5CVSS 3.1, MediumKEVDue 13 Mar 2025EPSS2%
  25. CVE-2025-0108Published:

    PAN-OS: Authentication Bypass in the Management Web Interface

    Palo Alto Networks PAN-OS

    Critical9.1CVSS 3.1, CriticalKEVDue 11 Mar 2025EPSS98%
  26. CVE-2024-3393Published:

    PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

    Palo Alto Networks PAN-OS

    High7.5CVSS 3.1, HighKEVDue 20 Jan 2025EPSS28%
  27. CVE-2024-9474Published:

    PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighKEVRansomwareDue 9 Dec 2024EPSS95%
  28. CVE-2024-0012Published:

    PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

    Palo Alto Networks PAN-OS

    Critical9.8CVSS 3.1, CriticalKEVRansomwareDue 9 Dec 2024EPSS100%
  29. CVE-2024-2550Published:

    PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet

    Palo Alto Networks PAN-OS

    High7.5CVSS 3.1, HighEPSS0.51%
  30. CVE-2024-2551Published:

    PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet

    Palo Alto Networks PAN-OS

    High7.5CVSS 3.1, HighEPSS0.48%
  31. CVE-2024-9468Published:

    PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet

    Palo Alto Networks PAN-OS

    High7.5CVSS 3.1, HighEPSS0.41%
  32. CVE-2024-8691Published:

    PAN-OS: User Impersonation in GlobalProtect Portal

    Palo Alto Networks PAN-OS

    High7.1CVSS 3.1, HighEPSS0.32%
  33. CVE-2024-8687Published:

    PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes

    Palo Alto Networks PAN-OS, Palo Alto Networks GlobalProtect App, Palo Alto Networks Prisma Access

    High7.1CVSS 3.1, HighEPSS0.41%
  34. CVE-2024-8686Published:

    PAN-OS: Command Injection Vulnerability

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS1%
  35. CVE-2024-3400Published:

    PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect

    Palo Alto Networks PAN-OS

    Critical10CVSS 3.1, CriticalKEVRansomwareDue 19 Apr 2024EPSS100%
  36. CVE-2024-3385Published:

    PAN-OS: Firewall Denial of Service (DoS) when GTP Security is Disabled

    Palo Alto Networks PAN-OS

    High7.5CVSS 3.1, HighEPSS0.91%
  37. CVE-2024-3384Published:

    PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets

    Palo Alto Networks PAN-OS

    High7.5CVSS 3.1, HighEPSS0.89%
  38. CVE-2024-3383Published:

    PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)

    Palo Alto Networks PAN-OS

    Critical9.1CVSS 3.1, CriticalEPSS0.58%
  39. CVE-2024-3382Published:

    PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted Packets

    Palo Alto Networks PAN-OS

    High7.5CVSS 3.1, HighEPSS0.93%
  40. CVE-2024-0008Published:

    PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface

    Palo Alto Networks PAN-OS

    High8.8CVSS 3.1, HighEPSS0.50%
  41. CVE-2022-0028Published:

    PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering

    Palo Alto Networks PAN-OS

    High8.6CVSS 3.1, HighKEVDue 12 Sept 2022EPSS2%
  42. CVE-2020-2021Published:

    PAN-OS: Authentication Bypass in SAML Authentication

    Palo Alto Networks PAN-OS

    Critical10CVSS 3.1, CriticalKEVRansomwareDue 15 Apr 2022EPSS4%

Vendor recommendation

The vendor's own statement about what to run, with its date and source. Separate from vulnerabilities and from support status: being behind a recommendation is not a vulnerability, and a supported release is not necessarily the recommended one.

Palo Alto Networks publishes no recommended-release page Patcharo can read. The fixed releases on this site come from the security advisories only; nothing is inferred from version numbers.

CERT-FR

Advisories and alerts of the French national CERT referencing the CVEs of this product.

  • Advisory (AVI)CERTFR-2026-AVI-1014Multiple vulnerabilities in Palo Alto Networks productsPublished 13 Aug 2026
  • Advisory (AVI)CERTFR-2026-AVI-0853Multiple vulnerabilities in Palo Alto Networks productsPublished 9 Jul 2026
  • Advisory (AVI)CERTFR-2026-AVI-0734Multiple vulnerabilities in Palo Alto Networks productsPublished 11 Jun 2026
  • Advisory (AVI)CERTFR-2026-AVI-0596Multiple vulnerabilities in Palo Alto Networks productsPublished 15 May 2026
  • Advisory (AVI)CERTFR-2026-AVI-0537Vulnerability in Palo Alto Networks User-ID Authentication PortalPublished 6 May 2026
  • Advisory (AVI)CERTFR-2026-AVI-0049Multiple vulnerabilities in Palo Alto Networks productsPublished 15 Jan 2026
  • Advisory (AVI)CERTFR-2025-AVI-0856Multiple vulnerabilities in Palo Alto Networks productsPublished 9 Oct 2025
  • Advisory (AVI)CERTFR-2025-AVI-0505Multiple vulnerabilities in Palo Alto Networks productsPublished 12 Jun 2025
  • Advisory (AVI)CERTFR-2025-AVI-0410Multiple vulnerabilities in Palo Alto Networks productsPublished 15 May 2025
  • Advisory (AVI)CERTFR-2025-AVI-0204Multiple vulnerabilities in Palo Alto Networks productsPublished 13 Mar 2025

Some titles in this list are machine-translated by artificial intelligence (Mistral AI) from the source texts; each record shows the original.

Official sources