Skip to content
Patcharo

Vendors

Palo Alto Networks vulnerabilities: CVE, KEV, fixed releases

Palo Alto Networks vulnerabilities, tracked with their affected releases, the vendor's official fixes and known exploitation.

Sources last modified 24 Sept 2026 · Last verified by Patcharo: 1 Oct 2026 at 13:37 UTC

48
CVEs tracked
14
Critical
15
CISA KEV
41
With a fixed release

Published CVEs per product

Distinct CVEs NVD attaches to each product over the period chosen, whatever their score. A CVE common to two products counts in each.

Compare products

Last 10 years · 14 Nov 2016 – 14 Nov 2026 · Rolling calendar period, by publication date of the CVE record; both days included.

The history could not be read right now. The list below shows the analysed catalog only.

Products covered

Each product has its own page with affected branches and fixed releases.

Latest vulnerabilities

Newest source publication first.

All Palo Alto Networks CVEs
  1. CVE-2026-0301Published:

    PAN-OS: Information Disclosure Vulnerability in URL Filtering

    Palo Alto Networks PAN-OS, Palo Alto Networks Cloud NGFW, Palo Alto Networks Prisma Access

    High7.5CVSS 3.1, HighEPSS0.32%
  2. CVE-2026-0280Published:

    PAN-OS: IPv6 Firewall Policy Bypass

    Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access

    High7.2CVSS 3.1, HighEPSS0.34%
  3. CVE-2026-0281Published:

    PAN-OS: Information Disclosure Vulnerability in Management Web Interface

    Palo Alto Networks PAN-OS

    High7.1CVSS 3.1, HighEPSS0.28%
  4. CVE-2026-0283Published:

    PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS0.38%
  5. CVE-2026-0284Published:

    PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)

    Palo Alto Networks PAN-OS

    Critical9.9CVSS 3.1, CriticalEPSS0.47%
  6. CVE-2026-0286Published:

    PAN-OS: Authenticated Command Injection in CLI

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS2%
  7. CVE-2026-0287Published:

    PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing

    Palo Alto Networks PAN-OS, Palo Alto Networks Cloud NGFW, Palo Alto Networks Prisma Access

    High7.5CVSS 3.1, HighEPSS0.62%
  8. CVE-2026-0288Published:

    PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent

    Palo Alto Networks PAN-OS, Palo Alto Networks Cloud NGFW, Palo Alto Networks Prisma Access

    High7.5CVSS 3.1, HighEPSS0.83%
  9. CVE-2026-0273Published:

    PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS1%
  10. CVE-2026-0272Published:

    PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI)

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighEPSS0.26%

Known exploited (CISA KEV)

Vulnerabilities CISA lists as exploited, with the federal remediation due date.

All Palo Alto Networks KEV entries
  1. CVE-2026-0257Published:

    PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

    Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access

    Critical9.1CVSS 3.1, CriticalKEVRansomwareDue 1 Jun 2026EPSS96%
  2. CVE-2026-0300Published:

    PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

    Palo Alto Networks PAN-OS

    Critical9.8CVSS 3.1, CriticalKEVDue 9 May 2026EPSS32%
  3. CVE-2025-0111Published:

    PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface

    Palo Alto Networks PAN-OS

    Medium6.5CVSS 3.1, MediumKEVDue 13 Mar 2025EPSS2%
  4. CVE-2025-0108Published:

    PAN-OS: Authentication Bypass in the Management Web Interface

    Palo Alto Networks PAN-OS

    Critical9.1CVSS 3.1, CriticalKEVDue 11 Mar 2025EPSS98%
  5. CVE-2024-3393Published:

    PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

    Palo Alto Networks PAN-OS

    High7.5CVSS 3.1, HighKEVDue 20 Jan 2025EPSS28%
  6. CVE-2024-9474Published:

    PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

    Palo Alto Networks PAN-OS

    High7.2CVSS 3.1, HighKEVRansomwareDue 9 Dec 2024EPSS95%
  7. CVE-2024-0012Published:

    PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

    Palo Alto Networks PAN-OS

    Critical9.8CVSS 3.1, CriticalKEVRansomwareDue 9 Dec 2024EPSS100%
  8. CVE-2024-9465Published:

    Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure

    Palo Alto Networks Expedition

    Critical9.1CVSS 3.1, CriticalKEVDue 5 Dec 2024EPSS100%
  9. CVE-2024-9463Published:

    Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure

    Palo Alto Networks Expedition

    High7.5CVSS 3.1, HighKEVDue 5 Dec 2024EPSS99%
  10. CVE-2024-5910Published:

    Expedition: Missing Authentication Leads to Admin Account Takeover

    Palo Alto Networks Expedition

    Critical9.8CVSS 3.1, CriticalKEVDue 28 Nov 2024EPSS92%

Vendor recommendation

The vendor's own statement about what to run, with its date and source. Separate from vulnerabilities and from support status: being behind a recommendation is not a vulnerability, and a supported release is not necessarily the recommended one.

Palo Alto Networks publishes no recommended-release page Patcharo can read. The fixed releases on this site come from the security advisories only; nothing is inferred from version numbers.

CERT-FR

Advisories and alerts of the French national CERT referencing the vendor.

  • Advisory (AVI)CERTFR-2026-AVI-1156Multiple vulnerabilities in Palo Alto Networks productsPublished 10 Sept 2026
  • Advisory (AVI)CERTFR-2026-AVI-1014Multiple vulnerabilities in Palo Alto Networks productsPublished 13 Aug 2026
  • Advisory (AVI)CERTFR-2026-AVI-0853Multiple vulnerabilities in Palo Alto Networks productsPublished 9 Jul 2026
  • Advisory (AVI)CERTFR-2026-AVI-0734Multiple vulnerabilities in Palo Alto Networks productsPublished 11 Jun 2026
  • Advisory (AVI)CERTFR-2026-AVI-0596Multiple vulnerabilities in Palo Alto Networks productsPublished 15 May 2026
  • Advisory (AVI)CERTFR-2026-AVI-0537Vulnerability in Palo Alto Networks User-ID Authentication PortalPublished 6 May 2026
  • Advisory (AVI)CERTFR-2026-AVI-0412Multiple vulnerabilities in Palo Alto Networks productsPublished 9 Apr 2026
  • Advisory (AVI)CERTFR-2026-AVI-0277Multiple vulnerabilities in Palo Alto Networks productsPublished 12 Mar 2026
  • Advisory (AVI)CERTFR-2026-AVI-0160Multiple vulnerabilities in Palo Alto Networks productsPublished 12 Feb 2026
  • Advisory (AVI)CERTFR-2026-AVI-0049Multiple vulnerabilities in Palo Alto Networks productsPublished 15 Jan 2026

Some titles in this list are machine-translated by artificial intelligence (Mistral AI) from the source texts; each record shows the original.

Support lifecycle

From the vendor's published life cycle policy.

  1. PAN-OS11.1
    SupportApproaching end of support
    End of support3 May 2027
  2. PAN-OS11.2
    SupportApproaching end of support
    End of support2 May 2027
  3. PAN-OS12.1
    SupportSupported
    End of support28 Aug 2028
  4. PAN-OS12.2
    SupportSupported
    End of support30 Jul 2029
20 branches past their end of life
  1. PAN-OS1.3
    SupportEnd of life
    End of support20 Nov 2008
  2. PAN-OS10.0
    SupportEnd of life
    End of support16 Jul 2022
  3. PAN-OS10.1
    SupportEnd of life
    End of support1 Dec 2024
  4. PAN-OS10.2
    SupportEnd of life
    End of support27 Aug 2025
  5. PAN-OS11.0
    SupportEnd of life
    End of support17 Nov 2024
  6. PAN-OS2.0
    SupportEnd of life
    End of support20 May 2009
  7. PAN-OS2.1
    SupportEnd of life
    End of support5 Jan 2012
  8. PAN-OS3.0
    SupportEnd of life
    End of support17 Dec 2010
  9. PAN-OS3.1
    SupportEnd of life
    End of support30 Jun 2013
  10. PAN-OS4.0
    SupportEnd of life
    End of support31 Dec 2014
  11. PAN-OS4.1
    SupportEnd of life
    End of support30 Apr 2015
  12. PAN-OS5.0
    SupportEnd of life
    End of support13 Nov 2016
  13. PAN-OS6.0
    SupportEnd of life
    End of support19 Mar 2017
  14. PAN-OS6.1
    SupportEnd of life
    End of support25 Oct 2018
  15. PAN-OS7.0
    SupportEnd of life
    End of support4 Dec 2017
  16. PAN-OS7.1
    SupportEnd of life
    End of support30 Jun 2020
  17. PAN-OS8.0
    SupportEnd of life
    End of support31 Oct 2019
  18. PAN-OS8.1
    SupportEnd of life
    End of support1 Mar 2022
  19. PAN-OS9.0
    SupportEnd of life
    End of support1 Mar 2022
  20. PAN-OS9.1
    SupportEnd of life
    End of support30 Jun 2024

Appliance life cycle

End of sale, end of support and replacement of every Palo Alto Networks appliance model (92).

Official sources