Palo Alto Networks vulnerabilities
We track 114 vulnerabilities in Palo Alto Networks products across 36 products. 113 are rated high or critical, and 18 have been exploited in real attacks. The most recent was published on October 15, 2026.
Latest Palo Alto Networks vulnerabilities
- 7.2 High severity
Trust Protection Foundation: Improper Check for Unusual or Exceptional Conditions
Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.
- 8.7 High severity
Trust Protection Foundation: Exposure of Sensitive System Information to an Unauthorized Control Sphere
An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the envir
- 7.8 High severity
Prisma Browser: Improper Control of Generation of Code
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized comma
- 8.1 High severity
Cloud NGFW: Improper Verification of Cryptographic Signature
An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled. The risk is higher if CAS is enabled on
- 9.8 Critical severity
Cloud NGFW: Heap-based Buffer Overflow
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Pris
- 9.8 Critical severity
Cloud NGFW: Out-of-bounds Write
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition. Pa
- 7.8 High severity
Prisma Browser: Improper Protection of Alternate Path
An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication ch
- 9.8 Critical severity
Palo Alto Networks PAN-OS Out-of-bounds Write Exploited
A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls
- 9.1 Critical severity
Cortex XSOAR Microsoft Teams Marketplace: Improper Verification of Cryptographic Signature
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify protected resources.
- 8.8 High severity
Autonomous Digital Experience Manager: Improper Certificate Validation
A certificate validation vulnerability in Palo Alto Networks Autonomous Digital Experience Manager on Windows allows an unauthenticated attacker with adjacent network access to execute arbitrary code with NT AUTHORITY\SYSTEM privileges.
- 7.5 High severity
Cloud NGFW: Improper Check for Unusual or Exceptional Conditions
A vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to cause a denial of service (DoS) to the firewall. Repeated attempts to trigger this issue results in the firewall entering into maintenance mode.
- 7.2 High severity
Cloud NGFW: Improper Neutralization of Script in Attributes in a Web Page
An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands. The security risk posed by this issue
- 7.2 High severity
User-ID Credential Agent: Exposure of Sensitive System Information to an Unauthorized Control Sphere
An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the service account password under specific non-default configurations. This allows an unprivileged Domain User to escalate privileges by exploi
- 8.4 High severity
GlobalProtect App: Untrusted Search Path
An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. The GlobalProtect
- 8.8 High severity
GlobalProtect App: Improper Neutralization of Wildcards or Matching Symbols
An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrative user to escalate their privileges to root.
- 7.2 High severity
Cloud NGFW: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker must have network access to the management web interface and successfully authenticate to exploit thi
- 8.4 High severity
Cloud NGFW: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS C
- 7.5 High severity
Cloud NGFW: Improper Check for Unusual or Exceptional Conditions
A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeate
- 9.3 Critical severity
Prisma Access Browser: Improper Check for Unusual or Exceptional Conditions
An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy Rules. This enables the user to use Prisma Access Browser without any restrictions.
- 8.7 High severity
Cloud NGFW: Improper Check for Unusual or Exceptional Conditions
A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeat
- 7.1 High severity
Cloud NGFW: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. This issue is only applicable to PAN-OS VM-Series. This issue does not affe
- 8.3 High severity
Cloud NGFW: Session Fixation
When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perform actions as that GlobalProtect user. This requires the legitimate user to first click on a malic
- 7.0 High severity
GlobalProtect App: Execution with Unnecessary Privileges
A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. However, execution require
- 8.0 High severity
GlobalProtect App: Exposed Unsafe ActiveX Method
A vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a remote attacker to run ActiveX controls within the context of an authenticated Windows user. This enables the attacker to run commands as if they are a legitimate authenticated use
- 7.1 High severity
GlobalProtect App: Reliance on Untrusted Inputs in a Security Decision
A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. GlobalProtect App on macOS, Linux
- 7.5 High severity
PAN-OS: Uncontrolled Resource Consumption
A Denial of Service (DoS) vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software enables an unauthenticated attacker to render the service unavailable by sending a large number of specially crafted packets over a period of time. This
- 6.5 Medium severity
Palo Alto Networks PAN-OS File Read Exploited
An authenticated file read vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. You can grea
- 8.6 High severity
PAN-OS OpenConfig Plugin: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in the Palo Alto Networks PAN-OS OpenConfig plugin enables an authenticated administrator with the ability to make gNMI requests to the PAN-OS management web interface to bypass system restrictions and run arbitrary commands.
- 9.1 Critical severity
Palo Alto Networks PAN-OS Authentication Bypass Exploited
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain
- 9.8 Critical severity
Cloud NGFW: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations
- 9.1 Critical severity
Cloud NGFW: External Control of File Name or Path
An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem.
- 8.8 High severity
Cloud NGFW: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers
- 7.5 High severity
Palo Alto Networks PAN-OS Malicious DNS Packet Exploited
A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger thi
- 8.8 High severity
GlobalProtect App: Improper Certificate Validation
An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subn
- 7.2 High severity
Palo Alto Networks PAN-OS Management Interface OS Command Injection Exploited
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this
- 9.8 Critical severity
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Exploited
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or
- 8.7 High severity
Cloud NGFW: NULL Pointer Dereference
A null pointer dereference in Palo Alto Networks PAN-OS software on PA-800 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series hardware platforms when Decryption policy is enabled allows an unauthenticated attacker to crash PAN-OS by sending specific tr
- 7.5 High severity
Cloud NGFW: NULL Pointer Dereference
A null pointer dereference vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop a core system service on the firewall by sending a crafted packet through the data plane that causes a denial of service (DoS) condition.
- 7.5 High severity
Cloud NGFW: NULL Pointer Dereference
A null pointer dereference vulnerability in the GlobalProtect gateway in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to stop the GlobalProtect service on the firewall by sending a specially crafted packet that causes a denial of serv
- 7.8 High severity
GlobalProtect App: Execution with Unnecessary Privileges
A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM through the use of the repair functionality offered b