Advisories · Technology

Palo Alto Networks PAN-OS.

Every CVE that names Palo Alto Networks PAN-OS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-0107 CVE record

CVSS 7.7 HighCritical · CVSS 7+ and EPSS

Expedition: OS Command Injection Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Expedition
- Command injection
Not analysed yet 11 Jan 2025
CVE-2025-0106 CVE record

CVSS 6.9 Medium

Expedition: Wildcard Expansion Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Expedition
- CWE-155
Not analysed yet 11 Jan 2025
CVE-2025-0105 CVE record

CVSS 6.9 Medium

Expedition: Arbitrary File Deletion Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Expedition
- Path traversal
Not analysed yet 11 Jan 2025
CVE-2025-0104 CVE record

CVSS 7.0 High

Expedition: Cross-Site Scripting (XSS) Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Expedition
- Cross-site scripting (XSS)
Not analysed yet 11 Jan 2025
CVE-2025-0103 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Expedition: SQL Injection Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks Expedition
- SQL injection
Not analysed yet 11 Jan 2025
CVE-2024-3393 CVE record

CVSS 8.7 HighCritical · KEV, CVSS 7+ and EPSSKEV

PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-754
Not analysed yet 27 Dec 2024
CVE-2024-9474 CVE record

CVSS 6.9 MediumCritical · KEVKEV · ransomware

PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Command injection
Not analysed yet 18 Nov 2024
CVE-2024-0012 CVE record

CVSS 9.3 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Authentication bypass
Not analysed yet 18 Nov 2024
CVE-2024-2550 CVE record

CVSS 8.7 High

PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 14 Nov 2024
CVE-2024-5920 CVE record

CVSS 4.6 Medium

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
Not analysed yet 14 Nov 2024
CVE-2024-5917 CVE record

CVSS 2.1 Low

PAN-OS: Server-Side Request Forgery in WildFire
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Server-side request forgery (SSRF)
Not analysed yet 14 Nov 2024
CVE-2024-2552 CVE record

CVSS 6.8 Medium

PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI)
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Path traversal
Not analysed yet 14 Nov 2024
CVE-2024-5918 CVE record

CVSS 5.3 Medium

PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Weak cryptography or TLS
Not analysed yet 14 Nov 2024
CVE-2024-5919 CVE record

CVSS 5.1 Medium

PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- XML external entities (XXE)
Not analysed yet 14 Nov 2024
CVE-2024-2551 CVE record

CVSS 8.7 High

PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 14 Nov 2024
CVE-2024-9472 CVE record

CVSS 8.7 High

PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 14 Nov 2024
CVE-2024-9471 CVE record

CVSS 5.1 Medium

PAN-OS: Privilege Escalation (PE) Vulnerability in XML API
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Privilege escalation
Not analysed yet 9 Oct 2024
CVE-2024-9468 CVE record

CVSS 8.2 High

PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Memory corruption
Not analysed yet 9 Oct 2024
CVE-2024-8691 CVE record

CVSS 5.3 Medium

PAN-OS: User Impersonation in GlobalProtect Portal
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Broken access control
Not analysed yet 11 Sept 2024
CVE-2024-8688 CVE record

CVSS 6.7 Medium

PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI)
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- CWE-155
Not analysed yet 11 Sept 2024
CVE-2024-8687 CVE record

CVSS 6.9 Medium

PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes
- Palo Alto Networks PAN-OS
- Palo Alto Networks GlobalProtect App
- Information disclosure
Not analysed yet 11 Sept 2024
CVE-2024-8686 CVE record

CVSS 8.6 High

PAN-OS: Command Injection Vulnerability
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Command injection
Not analysed yet 11 Sept 2024
CVE-2024-5916 CVE record

CVSS 6.0 Medium

PAN-OS: Cleartext Exposure of External System Secrets
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- CWE-313
Not analysed yet 14 Aug 2024
CVE-2024-5913 CVE record

CVSS 6.1 Medium

PAN-OS: Improper Input Validation Vulnerability in PAN-OS
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- CWE-20
Not analysed yet 10 Jul 2024
CVE-2024-5911 CVE record

CVSS 7.0 High

PAN-OS: File Upload Vulnerability in the Panorama Web Interface
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Unrestricted file upload
Not analysed yet 10 Jul 2024
CVE-2024-3400 CVE record

CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Command injection
- CWE-20
Not analysed yet 12 Apr 2024
CVE-2024-3388 CVE record

CVSS 4.1 Medium

PAN-OS: User Impersonation in GlobalProtect SSL VPN
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Privilege escalation
- Broken access control
Not analysed yet 10 Apr 2024
CVE-2024-3387 CVE record

CVSS 5.3 Medium

PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Weak cryptography or TLS
Not analysed yet 10 Apr 2024
CVE-2024-3386 CVE record

CVSS 5.3 Medium

PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- CWE-436
Not analysed yet 10 Apr 2024
CVE-2024-3385 CVE record

CVSS 7.5 High

PAN-OS: Firewall Denial of Service (DoS) when GTP Security is Disabled
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Memory corruption
- CWE-20
Not analysed yet 10 Apr 2024
CVE-2024-3384 CVE record

CVSS 7.5 High

PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- CWE-1286
Not analysed yet 10 Apr 2024
CVE-2024-3383 CVE record

CVSS 7.4 High

PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE)
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- CWE-282
Not analysed yet 10 Apr 2024
CVE-2024-3382 CVE record

CVSS 7.5 High

PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted Packets
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Denial of service
Not analysed yet 10 Apr 2024
CVE-2024-2433 CVE record

CVSS 4.3 Medium

PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Privilege escalation
Not analysed yet 13 Mar 2024
CVE-2024-0011 CVE record

CVSS 4.3 Medium

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Cross-site scripting (XSS)
Not analysed yet 14 Feb 2024
CVE-2024-0010 CVE record

CVSS 4.3 Medium

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Portal
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Cross-site scripting (XSS)
Not analysed yet 14 Feb 2024
CVE-2024-0009 CVE record

CVSS 6.3 Medium

PAN-OS: Improper IP Address Verification in GlobalProtect Gateway
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- CWE-940
Not analysed yet 14 Feb 2024
CVE-2024-0008 CVE record

CVSS 6.6 Medium

PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Authentication bypass
Not analysed yet 14 Feb 2024
CVE-2024-0007 CVE record

CVSS 6.8 Medium

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Cross-site scripting (XSS)
Not analysed yet 14 Feb 2024
CVE-2023-6793 CVE record

CVSS 2.7 Low

PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Privilege escalation
Not analysed yet 13 Dec 2023
CVE-2023-6791 CVE record

CVSS 4.9 Medium

PAN-OS: Plaintext Disclosure of External System Integration Credentials
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- CWE-701
Not analysed yet 13 Dec 2023
CVE-2023-6789 CVE record

CVSS 4.3 Medium

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Cross-site scripting (XSS)
Not analysed yet 13 Dec 2023
CVE-2023-6795 CVE record

CVSS 5.5 Medium

PAN-OS: OS Command Injection Vulnerability in the Web Interface
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Command injection
Not analysed yet 13 Dec 2023
CVE-2023-6794 CVE record

CVSS 5.5 Medium

PAN-OS: File Upload Vulnerability in the Web Interface
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Unrestricted file upload
Not analysed yet 13 Dec 2023
CVE-2023-6792 CVE record

CVSS 5.5 Medium

PAN-OS: OS Command Injection Vulnerability in the XML API
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Command injection
Not analysed yet 13 Dec 2023
CVE-2023-6790 CVE record

CVSS 8.8 High

PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Cross-site scripting (XSS)
Not analysed yet 13 Dec 2023
CVE-2023-38046 CVE record

CVSS 5.5 Medium

PAN-OS: Read System Files and Resources During Configuration Commit
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- CWE-610
Not analysed yet 12 Jul 2023
CVE-2023-0010 CVE record

CVSS 5.4 Medium

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Cross-site scripting (XSS)
Not analysed yet 14 Jun 2023
CVE-2023-0008 CVE record

CVSS 4.4 Medium

PAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Path traversal
Not analysed yet 10 May 2023
CVE-2023-0007 CVE record

CVSS 6.5 Medium

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Cross-site scripting (XSS)
Not analysed yet 10 May 2023
CVE-2023-0005 CVE record

CVSS 4.1 Medium

PAN-OS: Exposure of Sensitive Information Vulnerability
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Information disclosure
Not analysed yet 12 Apr 2023
CVE-2023-0004 CVE record

CVSS 6.5 Medium

PAN-OS: Local File Deletion Vulnerability
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- CWE-703
Not analysed yet 12 Apr 2023
CVE-2022-0030 CVE record

CVSS 8.1 High

PAN-OS: Authentication Bypass in Web Interface
- Palo Alto Networks PAN-OS
- Palo Alto Networks Cloud NGFW
- Authentication bypass
Not analysed yet 12 Oct 2022
CVE-2022-0028 CVE record

CVSS 8.6 HighCritical · KEVKEV

PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- CWE-406
Not analysed yet 10 Aug 2022
CVE-2022-0024 CVE record

CVSS 7.2 High

PAN-OS: Improper Neutralization Vulnerability Leads to Unintended Program Execution During Configuration Commit
- Palo Alto Networks PAN-OS
- CWE-138
Not analysed yet 11 May 2022
CVE-2022-0023 CVE record

CVSS 5.9 Medium

PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS Proxy
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- CWE-755
Not analysed yet 13 Apr 2022
CVE-2022-0022 CVE record

CVSS 4.1 Medium

PAN-OS: Use of a Weak Cryptographic Algorithm for Stored Password Hashes
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Weak cryptography or TLS
Not analysed yet 9 Mar 2022
CVE-2022-0011 CVE record

CVSS 6.5 Medium

PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL Filtering
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- CWE-436
Not analysed yet 10 Feb 2022
CVE-2021-3064 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- Memory corruption
Not analysed yet 10 Nov 2021
CVE-2021-3063 CVE record

CVSS 7.5 High

PAN-OS: Denial-of-Service (DoS) Vulnerability in GlobalProtect Portal and Gateway Interfaces
- Palo Alto Networks PAN-OS
- Palo Alto Networks Prisma Access
- CWE-755
Not analysed yet 10 Nov 2021