Palo Alto Networks vulnerabilities in CISA KEV
Palo Alto Networks has 16 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 17th highest of any vendor. 3 were added in the last 12 months; 6 are linked to known ransomware use (37.5% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is PAN-OS, with 13 entries. Other frequently affected products: Expedition (3).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor palo-alto-networks --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
16
in CISA KEV
┌─ first added
2022-01-10
earliest entry
┌─ latest added
2026-10-14
most recent entry
┌─ last 12 months
3
entries added
┌─ ransomware use
6 of 16
37.5% linked to ransomware
┌─ distinct products
2
affected products
$ awk -F, {print $1} /var/log/kev/palo-alto-networks.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2022 | 4 | 2 |
| 2024 | 7 | 3 |
| 2025 | 2 | 0 |
| 2026 | 3 | 1 |
$ sort /var/log/kev/palo-alto-networks.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- PAN-OS 13 entries
- Expedition 3 entries
$ kev-due-dates --vendor palo-alto-networks
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Palo Alto Networks
21 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/palo-alto-networks.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (15 of 16 have at least one CWE).
$ grep -ril 'Palo Alto Networks' /var/log/news | head -5
Our reporting that names Palo Alto Networks or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
$ wc -l ./palo-alto-networks.kev · 16 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-0322
PAN-OS
Palo Alto Networks PAN-OS Code Injection Vulnerability
due 2026-10-17 · CWE-94
$ cat CVE-2026-0322.txt
Description. Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-0257
PAN-OS [RANSOMWARE]
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
due 2026-06-01 · CWE-565
$ cat CVE-2026-0257.txt
Description. Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2026-0300
PAN-OS
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
due 2026-05-09 · CWE-787
$ cat CVE-2026-0300.txt
Description. Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.
- CVE-2025-0111
PAN-OS
Palo Alto Networks PAN-OS File Read Vulnerability
due 2025-03-13 · CWE-73
$ cat CVE-2025-0111.txt
Description. Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2025-0108
PAN-OS
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
due 2025-03-11 · CWE-306
$ cat CVE-2025-0108.txt
Description. Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-3393
PAN-OS
Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
due 2025-01-20 · CWE-754
$ cat CVE-2024-3393.txt
Description. Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-0012
PAN-OS [RANSOMWARE]
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
due 2024-12-09 · CWE-306
$ cat CVE-2024-0012.txt
Description. Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.
- CVE-2024-9474
PAN-OS [RANSOMWARE]
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
due 2024-12-09 · CWE-77
$ cat CVE-2024-9474.txt
Description. Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
- CVE-2024-9463
Expedition
Palo Alto Networks Expedition OS Command Injection Vulnerability
due 2024-12-05 · CWE-78
$ cat CVE-2024-9463.txt
Description. Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-9465
Expedition
Palo Alto Networks Expedition SQL Injection Vulnerability
due 2024-12-05 · CWE-89
$ cat CVE-2024-9465.txt
Description. Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-5910
Expedition
Palo Alto Networks Expedition Missing Authentication Vulnerability
due 2024-11-28 · CWE-306
$ cat CVE-2024-5910.txt
Description. Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-3400
PAN-OS [RANSOMWARE]
Palo Alto Networks PAN-OS Command Injection Vulnerability
due 2024-04-19 · CWE-20 CWE-77
$ cat CVE-2024-3400.txt
Description. Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
Required action. Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
- CVE-2022-0028
PAN-OS
Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability
due 2022-09-12 · CWE-940
$ cat CVE-2022-0028.txt
Description. A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.
Required action. Apply updates per vendor instructions.
- CVE-2017-15944
PAN-OS
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
due 2022-09-08
$ cat CVE-2017-15944.txt
Description. Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.
Required action. Apply updates per vendor instructions.
- CVE-2020-2021
PAN-OS [RANSOMWARE]
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
due 2022-04-15 · CWE-347
$ cat CVE-2020-2021.txt
Description. Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
Required action. Apply updates per vendor instructions.
- CVE-2019-1579
PAN-OS [RANSOMWARE]
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
due 2022-07-10 · CWE-134
$ cat CVE-2019-1579.txt
Description. Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Required action. Apply updates per vendor instructions.