CVE-2026-0282
published 2026-07-09CVE-2026-0282: A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to…
PriorityP340medium6.5CVSS 3.1
AVNACLPRNUINSUCNILAL
EPSS
0.18%
7.5th percentile
A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory.
The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| palo_alto_networks | pan-os | >= 10.2.0 < 10.2.18-h8 | 10.2.18-h8 |
| palo_alto_networks | pan-os | >= 11.1.0 < 11.1.16 | 11.1.16 |
| palo_alto_networks | pan-os | >= 11.2.0 < 11.2.13 | 11.2.13 |
| palo_alto_networks | pan-os | >= 12.1.0 < 12.1.8 | 12.1.8 |
| paloalto | cloud_ngfw | — | — |
| paloalto | pan-os | — | — |
| paloalto | prisma_access | — | — |
| paloaltonetworks | pan-os | >= 10.2.0 < 11.1.16 | 11.1.16 |
| paloaltonetworks | pan-os | >= 11.2.0 < 11.2.13 | 11.2.13 |
| paloaltonetworks | pan-os | >= 12.1.0 < 12.1.8 | 12.1.8 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
nvdv4.02.7LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Palo Alto PAN-OS Management Web Interface input validation (EUVD-2026-42679)
vuldb·2026-07-09·CVSS 2.7
CVE-2026-0282 [LOW] Palo Alto PAN-OS Management Web Interface input validation (EUVD-2026-42679)
A vulnerability classified as critical was found in Palo Alto PAN-OS. This affects an unknown function of the component Management Web Interface. The manipulation results in improper input validation.
This vulnerability is identified as CVE-2026-0282. The attack can be executed remotely. There is not any exploit available.
GHSA
A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory.
ghsa_unreviewed·2026-07-09
CVE-2026-0282 [LOW] CWE-20 A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory.
A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory.
The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
Palo Alto
PAN-OS: File Deletion Vulnerability in Management Web Interface
vendor_paloalto·CVSS 6.9
CVE-2026-0282 CWE-20 PAN-OS: File Deletion Vulnerability in Management Web Interface
PAN-OS: File Deletion Vulnerability in Management Web Interface
A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory.
The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431).
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-09
Published