PA
Network Security
PAN-OS
On CISA KEVExploited in the wildRansomware-linked
288
CVEs
17
On KEV
10.0
Max CVSS
9
New 30D
Severity mix
Critical 28High 116Medium 106Low 17
Watch
Add PAN-OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-3400 RansomwareIn wildKEV | 10.0 | Apr 12 | PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect Affected: 10.2.0 before 10.2.9-h1; 11.0.0 before 11.0.4-h1; 11.1.0 before 11.1.2-h3 |
| CVE-2020-2021 RansomwareIn wildKEV | 10.0 | Jun 29 | PAN-OS: Authentication Bypass in SAML Authentication Affected: 8.0.*; 8.1 before 8.1.15; 9.0 before 9.0.9; 9.1 before 9.1.3 |
| CVE-2026-109618 In wildKEVNew | 9.8 | Oct 21 | RCE via OOM corruption Affected: 10.2.0 before 10.2.7; 10.2.7; 10.2.7; 10.2.7; 10.2.7; 10.2.7; +34 more |
| CVE-2026-0300 In wildKEV | 9.8 | May 6 | PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal Affected: 12.1.0 before 12.1.7; 11.2.0 before 11.2.12; 11.1.0 before 11.1.15; 10.2.0 before 10.2.18-h6 |
| CVE-2024-0012 RansomwareIn wildKEV | 9.8 | Nov 18 | PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) Affected: 11.2.0 before 11.2.4-h1; 11.1.0 before 11.1.5-h1; 11.0.0 before 11.0.6-h1; 10.2.0 before 10.2.12-h2 |
| CVE-2017-15944 In wildKEV | 9.8 | Dec 11 | Palo Alto Networks PAN-OS Remote Code Execution Vulnerability Affected: before 6.1.19; 7.0.0 before 7.0.19; 7.1.0 before 7.1.14; 8.0.0 before 8.0.6 |
| CVE-2026-0257 RansomwareIn wildKEV | 9.1 | May 13 | PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities Affected: 12.1.0 before 12.1.7, 12.1.4-h6; 11.2.0 before 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17; 11.1.0 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33; 10.2.0 before 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34 |
| CVE-2025-0108 In wildKEV | 9.1 | Feb 12 | PAN-OS: Authentication Bypass in the Management Web Interface Affected: 10.1.0 before 10.1.14-h9; 10.2.0 before 10.2.7-h24; 11.1.0 before 11.1.6-h1; 11.2.0 before 11.2.4-h4 |
| CVE-2022-0028 In wildKEV | 8.6 | Aug 10 | PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering Affected: 8.1 before 8.1.23-h1; 9.0 before 9.0.16-h3; 9.1 before 9.1.14-h4; 10.0 before 10.0.11-h1; 10.1 before 10.1.6-h6; 10.2 before 10.2.2-h2 |
| CVE-2026-109619 In wildKEVNew | 8.1 | Oct 21 | RCE via stale global state Affected: 10.2.0 before 10.2.7; 10.2.7; 10.2.7; 10.2.7; 10.2.7; 10.2.7; +34 more |
| CVE-2019-1579 RansomwareIn wildKEV | 8.1 | Jul 19 | Palo Alto Networks PAN-OS Remote Code Execution Vulnerability Affected: before 7.1.19; 8.0.0 before 8.0.12; 8.1.0 before 8.1.3 |
| CVE-2018-14634 In wildKEV | 7.8 | Sep 25 | Linux Kernel Integer Overflow Vulnerability Affected: 7.1.0 before 7.1.23; 8.0.0 before 8.0.16; 8.1.0 before 8.1.7 |
| CVE-2024-3393 In wildKEV | 7.5 | Dec 27 | PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet Affected: 11.2.0 before 11.2.3; 11.1.0 before 11.1.2-h16; 10.2.8 before 10.2.8-h19; 10.1.14 before 10.1.14-h8; 11.2.0 before 11.2.3 |
| CVE-2026-0322 In wildKEV | 7.2 | Oct 14 | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface Affected: 12.2.0 before 12.2.4; 12.1.0 before 12.1.10-h2; 11.2.0 before 11.2.16; 11.1.0 before 11.1.16-h3; 10.2.0 before 10.2.18-h12 |
| CVE-2024-9474 RansomwareIn wildKEV | 7.2 | Nov 18 | PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface Affected: 11.2.0 before 11.2.4-h1; 11.1.0 before 11.1.5-h1; 11.0.0 before 11.0.6-h1; 10.2.0 before 10.2.12-h2; 10.1.0 before 10.1.14-h6 |
| CVE-2016-5195 In wildKEV | 7.0 | Nov 10 | Linux Kernel Race Condition Vulnerability Affected: 5.1 before 7.0.14; 7.1.0 before 7.1.8 |
| CVE-2025-0111 In wildKEV | 6.5 | Feb 12 | PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface Affected: 10.1.0 before 10.1.14-h9; 10.2.0 before 10.2.7-h24; 11.1.0 before 11.1.6-h1; 11.2.0 before 11.2.4-h4 |
| CVE-2026-0284 | 9.9 | Jul 9 | PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) Affected: 12.1.0 before 12.1.4-h8; 11.2.0 before 11.2.4-h20; 11.1.0 before 11.1.4-h35; 10.2.0 before 10.2.7-h36 |
| CVE-2026-0263 | 9.8 | May 13 | PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing Affected: 12.1.0 before 12.1.7, 12.1.4-h5; 11.2.0 before 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17; 11.1.0 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33 |
| CVE-2026-0264 | 9.8 | May 13 | PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution Affected: 12.1.0 before 12.1.7, 12.1.4-h5; 11.2.0 before 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17; 11.1.0 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33; 10.2.0 before 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34 |
| CVE-2021-3064 | 9.8 | Nov 10 | A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system… Affected: 8.1.0 before 8.1.17 |
| CVE-2020-2040 | 9.8 | Sep 9 | A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a… Affected: 8.0.0 through 8.0.20; 8.1.0 before 8.1.15; 9.0.0 before 9.0.9; 9.1.0 before 9.1.3 |
| CVE-2020-2001 | 9.8 | May 13 | An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to… Affected: 7.1.0 through 7.1.26; 8.0.0 through 8.0.20; 8.1.0 before 8.1.12; 9.0.0 before 9.0.6 |
| CVE-2020-1992 | 9.8 | Apr 8 | A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card (LFC) allows remote attackers to crash the daemon creating a… Affected: 9.0.0 before 9.0.7; 9.1.0 before 9.1.2 |
| CVE-2019-17440 | 9.8 | Dec 20 | Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with… Affected: 9.0 through 9.0.5 |
| CVE-2019-1581 | 9.8 | Aug 23 | A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management… Affected: through 7.1.24; 8.0.0 through 8.0.19; 8.1.0 through 8.1.9; 9.0.0 through 9.0.3 |
| CVE-2019-1580 | 9.8 | Aug 23 | Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to… Affected: through 7.1.24; 8.0.0 through 8.0.19; 8.1.0 through 8.1.9; 9.0.0 through 9.0.3 |
| CVE-2017-15940 | 9.8 | Dec 11 | The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote… Affected: before 6.1.19; 7.0.0 before 7.0.19; 7.1.0 before 7.1.14; 8.0.0 before 8.0.6 |
| CVE-2017-9458 | 9.8 | Sep 7 | XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before… Affected: through 6.1.17; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +23 more |
| CVE-2017-8390 | 9.8 | Aug 2 | The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via a… Affected: through 6.1.17; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +25 more |
| CVE-2017-7945 | 9.8 | Apr 29 | The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for… Affected: through 6.1.15; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +23 more |
| CVE-2016-9150 | 9.8 | Nov 19 | Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and… Affected: 5.0.0 before 5.0.20; 5.1 before 5.1.13; 6.0.0 before 6.0.15; 6.1.0 before 6.1.15; 7.0.0 before 7.0.11; 7.1.0 before 7.1.6 |
| CVE-2016-3657 | 9.8 | Apr 12 | Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to… Affected: 5.0.0 before 5.0.18; 5.1 before 5.1.11; 6.0.0 before 6.0.13; 6.1.0 before 6.1.10; 7.0.0 through 7.0.5 |
| CVE-2016-3655 | 9.8 | Apr 12 | The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute… Affected: 5.0.0 before 5.0.18; 5.1 before 5.1.11; 6.0.0 before 6.0.13; 6.1.0 before 6.1.10; 7.0.0 through 7.0.5 |
| CVE-2026-0258 | 9.1 | May 13 | PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching Affected: 12.1.0 before 12.1.7, 12.1.4-h5; 11.2.0 before 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17; 11.1.0 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33; 10.2.0 before 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34 |
| CVE-2024-3383 | 9.1 | Apr 10 | A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups Affected: 10.1.0 before 10.1.11; 10.2.0 before 10.2.5; 11.0.0 before 11.0.3 |
| CVE-2020-2018 | 9.0 | May 13 | An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to gain privileged… Affected: 7.1.0 before 7.1.26; 8.0.0 through 8.0.20; 8.1.0 before 8.1.12; 9.0.0 before 9.0.6 |
| CVE-2026-0259 | 8.8 | May 13 | WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B) Affected: before 10.2.7; 10.2.8 before 10.2.10; 10.2.11 before 10.2.13; 10.2.14 before 10.2.16; 10.2.7; 10.2.7; +34 more |
| CVE-2025-4232 | 8.8 | Jun 13 | An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate… Affected: 6.0.0 before 6.2.8; 6.3.0 before 6.3.3 |
| CVE-2024-5921 | 8.8 | Nov 27 | An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers Affected: 6.1.0 before 6.1.6; 6.1.0 before 6.1.7; 6.1.0 before 6.2.1; 6.1.0 before 6.2.6; 6.1.0 before 6.2.6; 6.3.0 before 6.3.2; +1 more |
| CVE-2024-0008 | 8.8 | Feb 14 | Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access Affected: 10.2.0 before 10.2.5; 11.0.0 before 11.0.2; 10.1.0 before 10.1.10; 10.1.10; 10.0.0 before 10.0.12; 10.0.12; +4 more |
| CVE-2021-3062 | 8.8 | Nov 10 | An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance… Affected: 8.1.0 before 8.1.20; 9.0.0 before 9.0.14; 9.1.0 before 9.1.11; 10.0.0 before 10.0.8 |
| CVE-2021-3056 | 8.8 | Nov 10 | A memory corruption vulnerability in Palo Alto Networks PAN-OS GlobalProtect Clientless VPN enables an authenticated attacker to execute arbitrary code with root user privileges… Affected: 8.1.0 before 8.1.20; 9.0.0 before 9.0.14; 9.1.0 before 9.1.9; 10.0.0 |
| CVE-2021-3050 | 8.8 | Aug 11 | An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to execute arbitrary OS commands to escalate privileges Affected: 9.0.0 before 9.0.15; 9.1.0 before 9.1.11; 10.0.0 before 10.0.8; 10.1.0 before 10.1.2 |
| CVE-2020-2036 | 8.8 | Sep 9 | A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface Affected: 8.1.0 before 8.1.16; 9.0.0 before 9.0.9 |
| CVE-2020-2015 | 8.8 | May 13 | A buffer overflow vulnerability in the PAN-OS management server allows authenticated users to crash system processes or potentially execute arbitrary code with root privileges Affected: 7.1.0 before 7.1.26; 8.0.0 through 8.0.20; 8.1.0 before 8.1.13; 9.0.0 before 9.0.7; 9.1.0 before 9.1.1 |
| CVE-2020-2014 | 8.8 | May 13 | An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges Affected: 7.1.0 through 7.1.26; 8.0.0 through 8.0.20; 8.1.0 through 8.1.13; 9.0.0 through 9.0.6 |
| CVE-2020-2013 | 8.8 | May 13 | A cleartext transmission of sensitive information vulnerability in Palo Alto Networks PAN-OS Panorama that discloses an authenticated PAN-OS administrator's PAN-OS session cookie Affected: 7.1.0 through 7.1.26; 8.0.0 through 8.0.20; 8.1.0 before 8.1.13; 9.0.0 before 9.0.6; 9.1.0 before 9.1.1 |
| CVE-2020-2006 | 8.8 | May 13 | A stack-based buffer overflow vulnerability in the management server component of PAN-OS that allows an authenticated user to potentially execute arbitrary code with root… Affected: 7.1.0 through 7.1.26; 8.0.0 through 8.0.20; 8.1.0 through 8.1.13 |
| CVE-2020-1998 | 8.8 | May 13 | An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the… Affected: 7.1.0 before 7.1.26; 8.0.0 through 8.0.20; 8.1.0 before 8.1.13; 9.0.0 before 9.0.6; 9.1.0 before 9.1.1 |