Palo Alto Networks PAN-OS vulnerabilities

CVE-2024-3384 [HIGH] CWE-1286 CVE-2024-3384: A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS fir A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall back online.

CVE-2020-1981 [HIGH] CWE-377 CVE-2020-1981: A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This iss A predictable temporary filename vulnerability in PAN-OS allows local privilege escalation. This issue allows a local attacker who bypassed the restricted shell to execute commands as a low privileged user and gain root access on the PAN-OS hardware or virtual appliance. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. This issue

CVE-2026-0281 [HIGH] CWE-524 CVE-2026-0281: An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenti An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The security risk posed by this issue is minimized by restrictin

CVE-2024-8691 [HIGH] CWE-863 CVE-2024-8691: A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a maliciou A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vulnerability are disconnected from GlobalProtect. Upon exploitation, PAN-OS logs indicate that the

CVE-2021-3046 [MEDIUM] CWE-287 CVE-2021-3046: An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a An improper authentication vulnerability exists in Palo Alto Networks PAN-OS software that enables a SAML authenticated attacker to impersonate any other user in the GlobalProtect Portal and GlobalProtect Gateway when they are configured to use SAML authentication. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.19; PAN-OS 9.0 versions

CVE-2021-3054 [MEDIUM] CWE-367 CVE-2021-3054: A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-O A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0

CVE-2021-3055 [MEDIUM] CWE-611 CVE-2021-3055: An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networ An improper restriction of XML external entity (XXE) reference vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to read any arbitrary file from the file system and send a specifically crafted request to the firewall that causes the service to crash. Repeated attempts to send this request result in den

CVE-2025-0127 [HIGH] CWE-78 CVE-2025-0127: A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated ad A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. This issue is only applicable to PAN-OS VM-Series. This issue does not affect firewalls that are already deployed. Cloud NGFW and Prisma® Access are not affected by this

CVE-2024-8687 [HIGH] CWE-497 CVE-2024-8687: An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a Gl An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or passcode is known, end users can uninstall, disable, or disconnect GlobalProtect even if the Global

CVE-2020-2003 [MEDIUM] CWE-73 CVE-2020-2003: An external control of filename vulnerability in the command processing of PAN-OS allows an authenti An external control of filename vulnerability in the command processing of PAN-OS allows an authenticated administrator to delete arbitrary system files affecting the integrity of the system or causing denial of service to all PAN-OS services. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions before 8.1.14; PAN-OS 9.0 versions

CVE-2025-0125 [MEDIUM] CWE-83 CVE-2025-0125: An improper input neutralization vulnerability in the management web interface of the Palo Alto Netw An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You grea

CVE-2025-0115 [MEDIUM] CWE-41 CVE-2025-0115: A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN- A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attacker must have network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. You can greatly reduce the risk of this issue by restricting access to

CVE-2022-0011 [MEDIUM] CWE-436 CVE-2022-0011: PAN-OS software provides options to exclude specific websites from URL category enforcement and thos PAN-OS software provides options to exclude specific websites from URL category enforcement and those websites are blocked or allowed (depending on your rules) regardless of their associated URL category. This is done by creating a custom URL category list or by using an external dynamic list (EDL) in a URL Filtering profile. When the entries in these

CVE-2024-0009 [MEDIUM] CWE-940 CVE-2024-0009: An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PA An improper verification vulnerability in the GlobalProtect gateway feature of Palo Alto Networks PAN-OS software enables a malicious user with stolen credentials to establish a VPN connection from an unauthorized IP address.

CVE-2023-0004 [MEDIUM] CWE-703 CVE-2023-0004: A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated a A local file deletion vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to delete files from the local file system with elevated privileges. These files can include logs and system components that impact the integrity and availability of PAN-OS software.

CVE-2026-0279 [MEDIUM] CWE-79 CVE-2026-0279: Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Por Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload. The security risk posed by this issue is minimized

CVE-2020-2016 [HIGH] CWE-377 CVE-2020-2016: A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator, possibly by exploiting another vulnerability, to escalate privileges to become root use

CVE-2024-3387 [MEDIUM] CWE-326 CVE-2024-3387: A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an atta A weak (low bit strength) device certificate in Palo Alto Networks Panorama software enables an attacker to perform a meddler-in-the-middle (MitM) attack to capture encrypted traffic between the Panorama management server and the firewalls it manages. With sufficient computing resources, the attacker could break encrypted communication and expose sens

CVE-2023-6795 [MEDIUM] CWE-78 CVE-2023-6795: An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated An OS command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to disrupt system processes and potentially execute arbitrary code with limited privileges on the firewall.

CVE-2018-10139 [MEDIUM] CWE-79 CVE-2018-10139: The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-O The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected.