Paloaltonetworks PAN-OS vulnerabilities

CVE-2012-6594 [CRITICAL] CWE-78 CVE-2012-6594: The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11, 4.0.x befor The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11, 4.0.x before 4.0.8, and 4.1.x before 4.1.1 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34299.

CVE-2012-6595 [CRITICAL] CWE-78 CVE-2012-6595: The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1 The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 34595.

CVE-2012-6603 [CRITICAL] CWE-287 CVE-2012-6603: The web management UI in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x bef The web management UI in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to bypass authentication and obtain administrator privileges via unspecified vectors, aka Ref ID 37034.

CVE-2020-1975 [HIGH] CWE-112 CVE-2020-1975: Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS softwa Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS

CVE-2021-3062 [HIGH] CWE-284 CVE-2021-3062: An improper access control vulnerability in PAN-OS software enables an attacker with authenticated a An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to perform any operations allowed by the EC2 role in AWS. Thi

CVE-2021-3059 [HIGH] CWE-78 CVE-2021-3059: An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists w An OS command injection vulnerability in the Palo Alto Networks PAN-OS management interface exists when performing dynamic updates. This vulnerability enables a man-in-the-middle attacker to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS

CVE-2012-6600 [CRITICAL] CWE-78 CVE-2012-6600: The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1 The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.9 and 4.1.x before 4.1.2 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 34502.

CVE-2012-6599 [CRITICAL] CWE-78 CVE-2012-6599: The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 and 4.1 The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 and 4.1.x before 4.1.1 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33476.

CVE-2012-6598 [CRITICAL] CWE-78 CVE-2012-6598: The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows The device-management command-line interface in Palo Alto Networks PAN-OS 4.0.x before 4.0.8 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 33080.

CVE-2012-6591 [CRITICAL] CWE-78 CVE-2012-6591: The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x be The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote authenticated administrators to execute arbitrary commands via unspecified vectors, aka Ref ID 31116.

CVE-2022-0030 [HIGH] CWE-290 CVE-2022-0030: An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a n An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privileged actions.

CVE-2020-2012 [HIGH] CWE-611 CVE-2020-2012: Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Pa Improper restriction of XML external entity reference ('XXE') vulnerability in Palo Alto Networks Panorama management service allows remote unauthenticated attackers with network access to the Panorama management interface to read arbitrary files on the system. This issue affects: All versions of PAN-OS for Panorama 7.1 and 8.0; PAN-OS for Panorama 8.1

CVE-2024-3383 [CRITICAL] CWE-282 CVE-2024-3383: A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identit A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed access to resources based on your existing Security Policy rules.

CVE-2020-2037 [HIGH] CWE-78 CVE-2020-2037: An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated a An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.

CVE-2020-2050 [HIGH] CWE-285 CVE-2020-2050: An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Ne An authentication bypass vulnerability exists in the GlobalProtect SSL VPN component of Palo Alto Networks PAN-OS software that allows an attacker to bypass all client certificate checks with an invalid certificate. A remote attacker can successfully authenticate as any user and gain access to restricted VPN network resources when the gateway or portal

CVE-2017-7945 [CRITICAL] CWE-209 CVE-2017-7945: The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requ

CVE-2012-6602 [CRITICAL] CWE-78 CVE-2012-6602: The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x be The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote authenticated users to execute arbitrary commands via unspecified vectors, aka Ref ID 30122.

CVE-2025-4231 [HIGH] CWE-77 CVE-2025-4231: A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrat A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker must have network access to the management web interface and successfully authenticate to exploit this issue. Cloud NGFW and Prisma Access are not impacted by this vulnerability.

CVE-2020-2010 [HIGH] CWE-78 CVE-2020-2010: An OS command injection vulnerability in PAN-OS management interface allows an authenticated adminis An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7.

CVE-2012-6604 [CRITICAL] CWE-78 CVE-2012-6604: The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x be The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.11 and 4.0.x before 4.0.9 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka Ref ID 35249.