Advisories · Technology

Palo Alto Networks Cloud NGFW.

Every CVE that names Palo Alto Networks Cloud NGFW among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-0316 CVE record

CVSS 1.1 Low

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 14 Oct 2026
CVE-2026-0317 CVE record

CVSS 1.2 Low

PAN-OS: Denial of Service Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 14 Oct 2026
CVE-2026-0318 CVE record

CVSS 4.6 Medium

PAN-OS: Denial of Service (DoS) on Panorama
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 14 Oct 2026
CVE-2026-0319 CVE record

CVSS 4.9 Medium

PAN-OS: Improper Input Handling Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 14 Oct 2026
CVE-2026-0320 CVE record

CVSS 6.1 Medium

PAN-OS: Authenticated Admin Command Injection Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 14 Oct 2026
CVE-2026-0321 CVE record

CVSS 6.6 Medium

PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 14 Oct 2026
CVE-2026-0322 CVE record

CVSS 8.6 HighCritical · KEVKEV

PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Code injection
Not analysed yet 14 Oct 2026
CVE-2026-0308 CVE record

CVSS 1.1 Low

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 10 Sept 2026
CVE-2026-0309 CVE record

CVSS 4.0 Medium

PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 10 Sept 2026
CVE-2026-0310 CVE record

CVSS 7.2 High

PAN-OS: Buffer Overflow Vulnerability via XML Processing
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 10 Sept 2026
CVE-2026-0301 CVE record

CVSS 1.7 Low

PAN-OS: Information Disclosure Vulnerability in URL Filtering
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 13 Aug 2026
CVE-2026-0279 CVE record

CVSS 1.3 Low

PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 9 Jul 2026
CVE-2026-0280 CVE record

CVSS 1.7 Low

PAN-OS: IPv6 Firewall Policy Bypass
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 9 Jul 2026
CVE-2026-0281 CVE record

CVSS 2.1 Low

PAN-OS: Information Disclosure Vulnerability in Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-524
Not analysed yet 9 Jul 2026
CVE-2026-0282 CVE record

CVSS 2.7 Low

PAN-OS: File Deletion Vulnerability in Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-20
Not analysed yet 9 Jul 2026
CVE-2026-0283 CVE record

CVSS 4.5 Medium

PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Authentication bypass
Not analysed yet 9 Jul 2026
CVE-2026-0284 CVE record

CVSS 4.7 Medium

PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Other injection
Not analysed yet 9 Jul 2026
CVE-2026-0285 CVE record

CVSS 4.7 Medium

PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Server-side request forgery (SSRF)
Not analysed yet 9 Jul 2026
CVE-2026-0286 CVE record

CVSS 6.0 Medium

PAN-OS: Authenticated Command Injection in CLI
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 9 Jul 2026
CVE-2026-0287 CVE record

CVSS 6.6 Medium

PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 9 Jul 2026
CVE-2026-0288 CVE record

CVSS 7.2 High

PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 8 Jul 2026
CVE-2026-0273 CVE record

CVSS 6.1 Medium

PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 10 Jun 2026
CVE-2026-0272 CVE record

CVSS 6.0 Medium

PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI)
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Broken access control
Not analysed yet 10 Jun 2026
CVE-2026-0269 CVE record

CVSS 4.6 Medium

PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 10 Jun 2026
CVE-2026-0266 CVE record

CVSS 1.1 Low

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 10 Jun 2026
CVE-2026-0256 CVE record

CVSS 4.4 Medium

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 13 May 2026
CVE-2026-0257 CVE record

CVSS 7.8 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-565
Not analysed yet 13 May 2026
CVE-2026-0258 CVE record

CVSS 4.8 Medium

PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Server-side request forgery (SSRF)
Not analysed yet 13 May 2026
CVE-2026-0261 CVE record

CVSS 6.1 Medium

PAN-OS: Authenticated Admin Command Injection Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 13 May 2026
CVE-2026-0262 CVE record

CVSS 6.6 Medium

PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 13 May 2026
CVE-2026-0263 CVE record

CVSS 7.2 High

PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 13 May 2026
CVE-2026-0264 CVE record

CVSS 7.2 High

PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 13 May 2026
CVE-2026-0265 CVE record

CVSS 7.2 High

PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Weak cryptography or TLS
Not analysed yet 13 May 2026
CVE-2026-0300 CVE record

CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 6 May 2026
CVE-2026-0229 CVE record

CVSS 6.6 Medium

PAN-OS: Denial of Service in Advanced DNS Security Feature
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 11 Feb 2026
CVE-2026-0228 CVE record

CVSS 1.3 Low

PAN-OS: Improper Validation of Terminal Server Agent Certificate
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Weak cryptography or TLS
Not analysed yet 11 Feb 2026
CVE-2026-0227 CVE record

CVSS 6.6 Medium

PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 15 Jan 2026
CVE-2025-4619 CVE record

CVSS 6.6 Medium

PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Packets
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 13 Nov 2025
CVE-2025-4615 CVE record

CVSS 5.4 Medium

PAN-OS: Improper Neutralization of Input in the Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 9 Oct 2025
CVE-2025-4614 CVE record

CVSS 4.8 Medium

PAN-OS: Session Token Disclosure Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 9 Oct 2025
CVE-2025-2182 CVE record

CVSS 5.6 Medium

PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 13 Aug 2025
CVE-2025-4229 CVE record

CVSS 6.0 Medium

PAN-OS: Traffic Information Disclosure Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 13 Jun 2025
CVE-2025-4230 CVE record

CVSS 8.4 High

PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 12 Jun 2025
CVE-2025-4231 CVE record

CVSS 8.6 High

PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 12 Jun 2025
CVE-2025-0136 CVE record

CVSS 5.3 Medium

PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Weak cryptography or TLS
Not analysed yet 14 May 2025
CVE-2025-0137 CVE record

CVSS 4.8 Medium

PAN-OS: Improper Neutralization of Input in the Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 14 May 2025
CVE-2025-0133 CVE record

CVSS 1.2 Low

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 14 May 2025
CVE-2025-0130 CVE record

CVSS 8.2 High

PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 14 May 2025
CVE-2025-0123 CVE record

CVSS 5.9 Medium

PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Information disclosure
Not analysed yet 11 Apr 2025
CVE-2025-0128 CVE record

CVSS 8.7 High

PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 11 Apr 2025
CVE-2025-0127 CVE record

CVSS 7.1 High

PAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-Series
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 11 Apr 2025
CVE-2025-0126 CVE record

CVSS 8.3 High

PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Authentication bypass
Not analysed yet 11 Apr 2025
CVE-2025-0125 CVE record

CVSS 6.9 Medium

PAN-OS: Improper Neutralization of Input in the Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 11 Apr 2025
CVE-2025-0124 CVE record

CVSS 5.1 Medium

PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Path traversal
Not analysed yet 11 Apr 2025
CVE-2025-0116 CVE record

CVSS 6.8 Medium

PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted LLDP Frame
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- CWE-754
Not analysed yet 12 Mar 2025
CVE-2025-0115 CVE record

CVSS 6.8 Medium

PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- CWE-41
Not analysed yet 12 Mar 2025
CVE-2025-0114 CVE record

CVSS 8.2 High

PAN-OS: Denial of Service (DoS) in GlobalProtect
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Denial of service
Not analysed yet 12 Mar 2025
CVE-2025-0111 CVE record

CVSS 7.1 HighCritical · KEVKEV

PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Path traversal
Not analysed yet 12 Feb 2025
CVE-2025-0109 CVE record

CVSS 6.9 Medium

PAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Path traversal
Not analysed yet 12 Feb 2025
CVE-2025-0108 CVE record

CVSS 8.8 HighCritical · KEV, CVSS 7+ and EPSSKEV

PAN-OS: Authentication Bypass in the Management Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Authentication bypass
Not analysed yet 12 Feb 2025