PAN-OS vulnerabilities | LiveThreat CVE Feed

Network Security

PAN-OS

by Palo Alto Networks · last CVE Oct 21, 2026

On CISA KEVExploited in the wildRansomware-linked

288

CVEs

On KEV

10.0

Max CVSS

New 30D

Vulnerabilities288 In the news12 Timeline

Severity mix

Critical 28High 116Medium 106Low 17

Severity

All severities288 Critical28 High116 Medium106 Low17

Exploitation

On CISA KEV17 Exploited in the wild17

Watch

Add PAN-OS to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-3400 RansomwareIn wildKEV	10.0	100%	Apr 12	PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect Affected: 10.2.0 before 10.2.9-h1; 11.0.0 before 11.0.4-h1; 11.1.0 before 11.1.2-h3
CVE-2020-2021 RansomwareIn wildKEV	10.0	4%	Jun 29	PAN-OS: Authentication Bypass in SAML Authentication Affected: 8.0.*; 8.1 before 8.1.15; 9.0 before 9.0.9; 9.1 before 9.1.3
CVE-2026-109618 In wildKEVNew	9.8	100%	Oct 21	RCE via OOM corruption Affected: 10.2.0 before 10.2.7; 10.2.7; 10.2.7; 10.2.7; 10.2.7; 10.2.7; +34 more
CVE-2026-0300 In wildKEV	9.8	42%	May 6	PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal Affected: 12.1.0 before 12.1.7; 11.2.0 before 11.2.12; 11.1.0 before 11.1.15; 10.2.0 before 10.2.18-h6
CVE-2024-0012 RansomwareIn wildKEV	9.8	100%	Nov 18	PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) Affected: 11.2.0 before 11.2.4-h1; 11.1.0 before 11.1.5-h1; 11.0.0 before 11.0.6-h1; 10.2.0 before 10.2.12-h2
CVE-2017-15944 In wildKEV	9.8	98%	Dec 11	Palo Alto Networks PAN-OS Remote Code Execution Vulnerability Affected: before 6.1.19; 7.0.0 before 7.0.19; 7.1.0 before 7.1.14; 8.0.0 before 8.0.6
CVE-2026-0257 RansomwareIn wildKEV	9.1	95%	May 13	PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities Affected: 12.1.0 before 12.1.7, 12.1.4-h6; 11.2.0 before 11.2.12, 11.2.10-h7, 11.2.7-h14, 11.2.4-h17; 11.1.0 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33; 10.2.0 before 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
CVE-2025-0108 In wildKEV	9.1	98%	Feb 12	PAN-OS: Authentication Bypass in the Management Web Interface Affected: 10.1.0 before 10.1.14-h9; 10.2.0 before 10.2.7-h24; 11.1.0 before 11.1.6-h1; 11.2.0 before 11.2.4-h4
CVE-2026-0284	9.9	0%	Jul 9	PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) Affected: 12.1.0 before 12.1.4-h8; 11.2.0 before 11.2.4-h20; 11.1.0 before 11.1.4-h35; 10.2.0 before 10.2.7-h36
CVE-2026-0263	9.8	0%	May 13	PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing Affected: 12.1.0 before 12.1.7, 12.1.4-h5; 11.2.0 before 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17; 11.1.0 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33
CVE-2026-0264	9.8	0%	May 13	PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution Affected: 12.1.0 before 12.1.7, 12.1.4-h5; 11.2.0 before 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17; 11.1.0 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33; 10.2.0 before 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
CVE-2021-3064	9.8	20%	Nov 10	A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system… Affected: 8.1.0 before 8.1.17
CVE-2020-2040	9.8	4%	Sep 9	A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a… Affected: 8.0.0 through 8.0.20; 8.1.0 before 8.1.15; 9.0.0 before 9.0.9; 9.1.0 before 9.1.3
CVE-2020-2001	9.8	1%	May 13	An external control of path and data vulnerability in the Palo Alto Networks PAN-OS Panorama XSLT processing logic that allows an unauthenticated user with network access to… Affected: 7.1.0 through 7.1.26; 8.0.0 through 8.0.20; 8.1.0 before 8.1.12; 9.0.0 before 9.0.6
CVE-2020-1992	9.8	3%	Apr 8	A format string vulnerability in the Varrcvr daemon of PAN-OS on PA-7000 Series devices with a Log Forwarding Card (LFC) allows remote attackers to crash the daemon creating a… Affected: 9.0.0 before 9.0.7; 9.1.0 before 9.1.2
CVE-2019-17440	9.8	2%	Dec 20	Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with… Affected: 9.0 through 9.0.5
CVE-2019-1581	9.8	3%	Aug 23	A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management… Affected: through 7.1.24; 8.0.0 through 8.0.19; 8.1.0 through 8.1.9; 9.0.0 through 9.0.3
CVE-2019-1580	9.8	3%	Aug 23	Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to… Affected: through 7.1.24; 8.0.0 through 8.0.19; 8.1.0 through 8.1.9; 9.0.0 through 9.0.3
CVE-2017-15940	9.8	5%	Dec 11	The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote… Affected: before 6.1.19; 7.0.0 before 7.0.19; 7.1.0 before 7.1.14; 8.0.0 before 8.0.6
CVE-2017-9458	9.8	2%	Sep 7	XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before… Affected: through 6.1.17; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +23 more
CVE-2017-8390	9.8	6%	Aug 2	The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via a… Affected: through 6.1.17; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +25 more
CVE-2017-7945	9.8	2%	Apr 29	The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for… Affected: through 6.1.15; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +23 more
CVE-2016-9150	9.8	35%	Nov 19	Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and… Affected: 5.0.0 before 5.0.20; 5.1 before 5.1.13; 6.0.0 before 6.0.15; 6.1.0 before 6.1.15; 7.0.0 before 7.0.11; 7.1.0 before 7.1.6
CVE-2016-3657	9.8	5%	Apr 12	Buffer overflow in the GlobalProtect Portal in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to… Affected: 5.0.0 before 5.0.18; 5.1 before 5.1.11; 6.0.0 before 6.0.13; 6.1.0 before 6.1.10; 7.0.0 through 7.0.5
CVE-2016-3655	9.8	3%	Apr 12	The management web interface in Palo Alto Networks PAN-OS before 5.0.18, 6.0.x before 6.0.13, 6.1.x before 6.1.10, and 7.0.x before 7.0.5 allows remote attackers to execute… Affected: 5.0.0 before 5.0.18; 5.1 before 5.1.11; 6.0.0 before 6.0.13; 6.1.0 before 6.1.10; 7.0.0 through 7.0.5
CVE-2026-0258	9.1	0%	May 13	PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching Affected: 12.1.0 before 12.1.7, 12.1.4-h5; 11.2.0 before 11.2.12, 11.2.10-h6, 11.2.7-h13, 11.2.4-h17; 11.1.0 before 11.1.15, 11.1.13-h5, 11.1.10-h25, 11.1.7-h6, 11.1.6-h32, 11.1.4-h33; 10.2.0 before 10.2.18-h6, 10.2.16-h7, 10.2.13-h21, 10.2.10-h36, 10.2.7-h34
CVE-2024-3383	9.1	1%	Apr 10	A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups Affected: 10.1.0 before 10.1.11; 10.2.0 before 10.2.5; 11.0.0 before 11.0.3
CVE-2020-2018	9.0	1%	May 13	An authentication bypass vulnerability in the Panorama context switching feature allows an attacker with network access to a Panorama's management interface to gain privileged… Affected: 7.1.0 before 7.1.26; 8.0.0 through 8.0.20; 8.1.0 before 8.1.12; 9.0.0 before 9.0.6