Palo Alto Networks PAN-OS 9.1
Vulnerabilities, fixed releases, vendor recommendation and support status of the 9.1 branch, from official sources.
Patcharo matches 7 vulnerabilities against Palo Alto Networks PAN-OS 9.1: 1 critical, 2 known exploited (CISA KEV). Newest fixed release stated by the vendor on this branch: 9.1.17. Last source modification: 17 Jun 2026.
Last verified by Patcharo: 30 Sept 2026 at 15:17 UTC
In brief
- Matched CVEs
- 7
- CISA KEV
- 2
- Newest fix stated
- 9.1.17
- Support
- No statement in the catalog
- Recommended maintenance build
- No official recommendation
- Recommended release
- No official recommendation
- CERT-FR
- 0 documents
Support status
From the vendor's published life-cycle policy; support is not a recommendation.
The life-cycle policy Patcharo reads states nothing about this branch.
Vendor recommendation
The vendor's own statement about what to run, with its date and source. Separate from vulnerabilities and from support status: being behind a recommendation is not a vulnerability, and a supported release is not necessarily the recommended one.
Palo Alto Networks publishes no recommended-release page Patcharo can read. The fixed releases on this site come from the security advisories only; nothing is inferred from version numbers.
Vulnerabilities affecting 9.1
Each record matched to this branch with the fixed release the source states, newest first.
| CVE | Severity | Fixed in | Published |
|---|---|---|---|
| CVE-2024-8691 PAN-OS: User Impersonation in GlobalProtect Portal | High7.1CVSS 3.1, High | 9.1.17 | |
| CVE-2024-8687 PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes | High7.1CVSS 3.1, High | 9.1.16 | |
| CVE-2024-3385 PAN-OS: Firewall Denial of Service (DoS) when GTP Security is Disabled | High7.5CVSS 3.1, High | 9.1.17 | |
| CVE-2024-3384 PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets | High7.5CVSS 3.1, High | 9.1.15-h1 | |
| CVE-2024-0008 PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface | High8.8CVSS 3.1, High | 9.1.17 | |
| CVE-2022-0028 PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering | High8.6CVSS 3.1, HighKEV | 9.1.14-h4 | |
| CVE-2020-2021 PAN-OS: Authentication Bypass in SAML Authentication | Critical10CVSS 3.1, CriticalKEVRansomware | 9.1.3 |
How Patcharo reads this
Affected and fixed releases come from the vendor's structured statements, matched by exact version and patch level. The recommendation is the vendor's own statement; the support status comes from its life-cycle policy. Unknown never becomes Not affected.