PA
Network Security
PAN-OS
On CISA KEVExploited in the wildRansomware-linked
288
CVEs
17
On KEV
10.0
Max CVSS
9
New 30D
Severity mix
Critical 28High 116Medium 106Low 17
Watch
Add PAN-OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0111 In wildKEV | 6.5 | Feb 12 | PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface Affected: 10.1.0 before 10.1.14-h9; 10.2.0 before 10.2.7-h24; 11.1.0 before 11.1.6-h1; 11.2.0 before 11.2.4-h4 |
| CVE-2024-5913 | 6.8 | Jul 10 | An improper input validation vulnerability in Palo Alto Networks PAN-OS software enables an attacker with the ability to tamper with the physical file system to elevate privileges Affected: 10.1.0 before 10.1.14; 10.2.0 before 10.2.10; 11.0.0 before 11.0.5; 11.1.0 before 11.1.4; 11.2.0 before 11.2.1; 10.1.14 |
| CVE-2020-1988 | 6.7 | Apr 8 | An unquoted search path vulnerability in the Windows release of Global Protect Agent allows an authenticated local user with file creation privileges on the root of the OS disk… Affected: 4.1.0 before 4.1.13; 5.0.0 before 5.0.5 |
| CVE-2017-15870 | 6.7 | Dec 11 | Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to gain SYSTEM privileges via vectors involving "image path… Affected: through 4.0.2 |
| CVE-2026-0321 | 6.6 | Oct 14 | PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services Affected: 12.2.0 before 12.2.4; 12.1.0 before 12.1.10-h2; 11.2.0 before 11.2.16; 11.1.0 before 11.1.16-h3; 10.2.0 before 10.2.18-h12 |
| CVE-2021-3054 | 6.6 | Sep 8 | A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to… Affected: 8.1.0 before 8.1.20; 9.0.0 before 9.0.14; 9.1.0 before 9.1.11; 10.0.0 before 10.0.7; 10.1.0 before 10.1.2 |
| CVE-2026-0282 | 6.5 | Jul 9 | PAN-OS: File Deletion Vulnerability in Management Web Interface Affected: 12.1.0 before 12.1.8; 11.2.0 before 11.2.13; 11.1.0 before 11.1.16; 10.2.0 before 10.2.18-h8 |
| CVE-2026-0249 | 6.5 | May 13 | GlobalProtect App: Certificate Validation Bypass Vulnerabilities Affected: 6.0.0 before 6.0.13; 6.0.0 before 6.0.14; 6.0.0 before 6.0.14; 6.1.0 before 6.1.14; 6.1.0 before 6.1.14; 6.2.0 before 6.2.8; +12 more |
| CVE-2024-5919 | 6.5 | Nov 14 | A blind XML External Entities (XXE) injection vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker to exfiltrate arbitrary files from… Affected: 10.1.0 before 10.1.10; 10.2.0 before 10.2.5; 11.0.0 before 11.0.2 |
| CVE-2023-0004 | 6.5 | Apr 12 | A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated… Affected: 8.1.0 before 8.1.24; 9.0.0 before 9.0.17; 9.1.0 before 9.1.15; 10.0.0 before 10.0.11; 10.1.0 before 10.1.6 |
| CVE-2022-0018 | 6.5 | Feb 10 | An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account are sent to the… Affected: 5.1 before 5.1.10; 5.2 before 5.2.9 |
| CVE-2022-0011 | 6.5 | Feb 10 | PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their… Affected: 8.1.0 before 8.1.21; 9.0.0 through 9.0.15; 9.1.0 before 9.1.12; 10.0.0 before 10.0.8; 10.1.0 before 10.1.3 |
| CVE-2021-3055 | 6.5 | Sep 8 | An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any… Affected: 8.1.0 before 8.1.20; 9.0.0 before 9.0.14; 9.1.0 before 9.1.10; 10.0.0 before 10.0.6 |
| CVE-2021-3046 | 6.5 | Aug 11 | An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a SAML authenticated attacker to impersonate any other user in the GlobalProtect… Affected: 8.1.0 before 8.1.19; 9.0.0 before 9.0.14; 9.1.0 before 9.1.9; 10.0.0 before 10.0.5 |
| CVE-2020-2003 | 6.5 | May 13 | An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affecting the integrity of… Affected: 7.1.0 through 7.1.26; 8.0.0 through 8.0.20; 8.1.0 through 8.1.13; 9.0.0 through 9.0.6; 9.1.0 before 9.1.1 |
| CVE-2018-18065 | 6.5 | Oct 8 | _set_key in agent/helpers/table_container.c in Net-SNMP before 5.8 has a NULL Pointer Exception bug that can be used by an authenticated attacker to remotely cause the instance to… Affected: through 7.1.22; 7.1.23 through 8.0.15; 8.0.16 through 8.1.6 |
| CVE-2017-7216 | 6.5 | May 2 | The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to obtain sensitive information via unspecified request parameters Affected: through 7.1.8 |
| CVE-2017-7644 | 6.5 | Apr 29 | The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, and 7.1.x before 7.1.9 allows remote authenticated users to obtain sensitive… Affected: through 6.1.15; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +21 more |
| CVE-2017-5583 | 6.5 | Mar 15 | The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authenticated users to read arbitrary files via… Affected: through 6.1.15; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +17 more |
| CVE-2016-9149 | 6.5 | Nov 19 | The Addresses Object parser in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x before 6.0.15, 6.1.x before 6.1.15, 7.0.x before 7.0.11, and 7.1.x before 7.1.6… Affected: 5.0.0 before 5.0.20; 5.1.0 before 5.1.13; 6.0.0 before 6.0.15; 6.1.0 before 6.1.15; 7.0.0 before 7.0.11; 7.1.0 before 7.1.6 |
| CVE-2024-0009 | 6.3 | Feb 14 | An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a… Affected: 11.0.0; 11.0.0; 11.0.0; 11.0.0; 11.0.0; 10.2.0 before 10.2.4 |
| CVE-2023-6792 | 6.3 | Dec 13 | An OS command injection vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated API user to disrupt system processes and potentially execute… Affected: 8.1.0 before 8.1.24; 9.0.0 before 9.0.17; 9.1.0 before 9.1.15; 10.0.0 before 10.0.12; 10.1.0 before 10.1.6 |
| CVE-2023-0006 | 6.3 | Apr 12 | A local file deletion vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a user to delete system files from the endpoint with elevated privileges… Affected: 5.2.0 before 5.2.13; 6.0.0 before 6.0.4; 6.1.0 |
| CVE-2026-0320 | 6.1 | Oct 14 | PAN-OS: Authenticated Admin Command Injection Vulnerability Affected: 12.2.0 before 12.2.4; 12.1.0 before 12.1.10-h2; 11.2.0 before 11.2.16; 11.1.0 before 11.1.16-h3; 10.2.0 before 10.2.18-h12 |
| CVE-2026-0279 | 6.1 | Jul 9 | PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities Affected: 12.1.0 before 12.1.8; 11.2.0 before 11.2.13; 11.1.0 before 11.1.16; 10.2.0 before 10.2.18-h8 |
| CVE-2024-0011 | 6.1 | Feb 14 | A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the context… Affected: 8.1.0 before 8.1.24; 9.0.0 before 9.0.17; 9.1.0 before 9.1.13; 10.0.0 before 10.0.11; 10.1.0 before 10.1.3 |
| CVE-2024-0010 | 6.1 | Feb 14 | A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript (in the… Affected: 10.1.0 before 10.1.11; 10.1.11; 9.1.0 before 9.1.17; 9.0.0 before 9.0.17; 9.0.17; 9.0.17; +2 more |
| CVE-2023-6790 | 6.1 | Dec 13 | A DOM-Based cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to execute a JavaScript payload in the context of an… Affected: 8.1.0 before 8.1.25; 9.0.0 before 9.0.17; 9.1.0 before 9.1.16; 10.0.0 before 10.0.12; 10.1.0 before 10.1.9; 10.2.0 before 10.2.4; +1 more |
| CVE-2020-2017 | 6.1 | May 13 | A DOM-Based Cross Site Scripting Vulnerability exists in PAN-OS and Panorama Management Web Interfaces Affected: 7.1.0 before 7.1.26; 8.0.0 through 8.0.20; 8.1.0 before 8.1.13; 9.0.0 before 9.0.6 |
| CVE-2020-2005 | 6.1 | May 13 | A cross-site scripting (XSS) vulnerability exists when visiting malicious websites with the Palo Alto Networks GlobalProtect Clientless VPN that can compromise the user's active… Affected: 7.1.0 before 7.1.26; 8.0.0 through 8.0.20; 8.1.0 before 8.1.13; 9.0.0 before 9.0.7 |
| CVE-2020-1997 | 6.1 | May 13 | An open redirection vulnerability in the GlobalProtect component of Palo Alto Networks PAN-OS allows an attacker to specify an arbitrary redirection target away from the trusted… Affected: 7.1.0 before 7.1.26; 8.0.0 before 8.0.14 |
| CVE-2019-1566 | 6.1 | Jan 30 | The PAN-OS management web interface in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an unauthenticated attacker to inject… Affected: PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier. |
| CVE-2018-10141 | 6.1 | Oct 12 | GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML Affected: before 6.1.0; 7.0.0 through 7.0.19; 8.1.0 before 8.1.4 |
| CVE-2018-10139 | 6.1 | Aug 16 | The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated… Affected: 6.1.21 and earlier; 7.1.18 and earlier; 8.0.11 and earlier |
| CVE-2018-7636 | 6.1 | Jul 3 | The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via specially crafted URLs Affected: 8.0.10 |
| CVE-2017-16878 | 6.1 | Jan 10 | Cross-site scripting (XSS) vulnerability in the Captive Portal function in Palo Alto Networks PAN-OS before 8.0.7 allows remote attackers to inject arbitrary web script or HTML by… Affected: before 8.0.7 |
| CVE-2017-15941 | 6.1 | Jan 10 | Cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.7, when the GlobalProtect… Affected: before 6.1.19; 7.0.0 before 7.0.19; 7.1.0 before 7.1.14; 8.0.0 before 8.0.7 |
| CVE-2017-12416 | 6.1 | Sep 7 | Cross-site scripting (XSS) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before… Affected: through 6.1.17; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +23 more |
| CVE-2017-9467 | 6.1 | Aug 2 | Cross-site scripting (XSS) vulnerability in the GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before… Affected: through 6.1.17; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +24 more |
| CVE-2017-9459 | 6.1 | Aug 2 | Cross-site scripting (XSS) vulnerability in the management web interface in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3… Affected: through 6.1.17; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +25 more |
| CVE-2017-7409 | 6.1 | Apr 21 | Palo Alto Networks PAN-OS before 7.0.15 has XSS in the GlobalProtect external interface via crafted request parameters, aka PAN-SA-2017-0011 and PAN-70674 Affected: through 7.0.14 |
| CVE-2024-2552 | 6.0 | Nov 14 | A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions in the management plane and delete… Affected: 10.2.0 before 10.2.7; 11.0.0 before 11.0.6; 11.1.0 before 11.1.4; 11.2.0 before 11.2.4; 10.2.7; 10.2.7; +34 more |
| CVE-2024-3387 | 5.9 | Apr 10 | A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted… Affected: 10.1.0 before 10.1.12; 10.2.0 before 10.2.7; 11.0.0 before 11.0.4; 10.2.7; 10.2.7; 10.2.7; +3 more |
| CVE-2022-0023 | 5.9 | Apr 13 | An improper handling of exceptional conditions vulnerability exists in the DNS proxy feature of Palo Alto Networks PAN-OS software that enables a meddler-in-the-middle (MITM) to… Affected: 8.1.0 before 8.1.22; 9.0.0 before 9.0.16; 9.1.0 before 9.1.13; 10.0.0 before 10.0.10; 10.1.0 before 10.1.5 |
| CVE-2021-3048 | 5.9 | Aug 11 | Certain invalid URL entries contained in an External Dynamic List (EDL) cause the Device Server daemon (devsrvr) to stop responding Affected: 9.0.0 before 9.0.14; 9.1.0 before 9.1.9; 10.0.0 before 10.0.5 |
| CVE-2017-17841 | 5.9 | Jan 10 | Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalProtect portal or gateway, might allow… Affected: 6.1.0; 7.1.0; 7.1.1; 7.1.2; 7.1.3; 7.1.4; +18 more |
| CVE-2026-0269 | 5.7 | Jun 10 | PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing Affected: 12.1.0 before 12.1.5; 11.2.0 before 11.2.10; 11.1.0 before 11.1.6-h21; 10.2.0 before 10.2.16-h6 |
| CVE-2026-0267 | 5.5 | Jun 10 | GlobalProtect App: Information Exposure Vulnerability on macOS Affected: 6.2.0 before 6.2.8; 6.3.0 before 6.3.3; 6.2.8; 6.2.8; 6.3.3 |
| CVE-2024-2431 | 5.5 | Mar 13 | An issue in the Palo Alto Networks GlobalProtect app enables a non-privileged user to disable the GlobalProtect app in configurations that allow a user to disable GlobalProtect… Affected: 5.1.0 before 5.1.12; 5.2.0 through 5.2.13; 6.0.0 before 6.0.4; 6.1.0 |
| CVE-2022-0021 | 5.5 | Feb 10 | An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting… Affected: 5.2 before 5.2.9 |