Prisma Access vulnerabilities

52 known vulnerabilities in Prisma Access from Palo Alto Networks. 51 are rated high or critical, and 10 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Cloud NGFW: Out-of-bounds Write

  CVE-2024-9468Oct 9, 2024Palo Alto Networks

  A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condi

• 7.1 High severity

  PAN-OS: Incorrect Authorization

  CVE-2024-8691Sep 11, 2024Palo Alto Networks

  A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vuln

• 7.1 High severity

  PAN-OS: Exposure of Sensitive System Information to an Unauthorized Control Sphere

  CVE-2024-8687Sep 11, 2024Palo Alto Networks

  An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or pass

• 7.2 High severity

  PAN-OS: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-8686Sep 11, 2024Palo Alto NetworksEPSS 1.41%

  A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall.

• 10.0 Critical severity

  Palo Alto Networks PAN-OS Command Injection Exploited

  CVE-2024-3400Apr 12, 2024Palo Alto NetworksEPSS 100%

  A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbit

• 7.5 High severity

  PAN-OS: NULL Pointer Dereference

  CVE-2024-3385Apr 10, 2024Palo Alto Networks

  A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall

• 7.5 High severity

  PAN-OS: Improper Validation of Syntactic Correctness of Input

  CVE-2024-3384Apr 10, 2024Palo Alto Networks

  A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenanc

• 9.1 Critical severity

  PAN-OS: Improper Ownership Management

  CVE-2024-3383Apr 10, 2024Palo Alto Networks

  A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed

• 7.5 High severity

  PAN-OS: Missing Release of Memory after Effective Lifetime

  CVE-2024-3382Apr 10, 2024Palo Alto Networks

  A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This issue applies only to PA-5400 Series devices that ar

• 8.8 High severity

  Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire…

  CVE-2024-0008Feb 14, 2024Palo Alto Networks

  Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.

• 8.1 High severity

  PAN-OS: Authentication Bypass by Spoofing

  CVE-2022-0030Oct 12, 2022Palo Alto Networks

  An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privilege

• 8.6 High severity

  Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Exploited

  CVE-2022-0028Aug 10, 2022Palo Alto NetworksEPSS 2.69%

  A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (vir