Palo Alto Networks vulnerabilities
We track 114 vulnerabilities in Palo Alto Networks products across 36 products. 113 are rated high or critical, and 18 have been exploited in real attacks. The most recent was published on October 15, 2026.
Latest Palo Alto Networks vulnerabilities
- 7.5 High severity
Cloud NGFW: Out-of-bounds Write
A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condi
- 9.1 Critical severity
Palo Alto Networks Expedition SQL Injection Exploited
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and
- 7.5 High severity
Palo Alto Networks Expedition OS Command Injection Exploited
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys
- 7.1 High severity
PAN-OS: Incorrect Authorization
A vulnerability in the GlobalProtect portal in Palo Alto Networks PAN-OS software enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect users impersonated by an attacker who is exploiting this vuln
- 7.1 High severity
PAN-OS: Exposure of Sensitive System Information to an Unauthorized Control Sphere
An information exposure vulnerability exists in Palo Alto Networks PAN-OS software that enables a GlobalProtect end user to learn both the configured GlobalProtect uninstall password and the configured disable or disconnect passcode. After the password or pass
- 7.2 High severity
PAN-OS: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as root on the firewall.
- 7.8 High severity
GlobalProtect App: Incorrect Permission Assignment for Critical Resource
A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges.
- 9.8 Critical severity
Cortex XSOAR CommonScripts: Improper Neutralization of Special Elements used in a Command
A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the context of an integration container.
- 9.8 Critical severity
Palo Alto Networks Expedition Missing Authentication Exploited
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichme
- 7.5 High severity
GlobalProtect App: Insertion of Sensitive Information into Log File
A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when gen
- 7.0 High severity
Cortex XDR Agent: Improper Privilege Management
A privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices enables a local user to execute programs with elevated privileges. However, execution does require the local user to successfully exploit a race condition,
- 7.6 High severity
DHCP: Missing Authentication for Critical Functionality
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network c
- 10.0 Critical severity
Palo Alto Networks PAN-OS Command Injection Exploited
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbit
- 7.5 High severity
PAN-OS: NULL Pointer Dereference
A packet processing mechanism in Palo Alto Networks PAN-OS software enables a remote attacker to reboot hardware-based firewalls. Repeated attacks eventually cause the firewall to enter maintenance mode, which requires manual intervention to bring the firewall
- 7.5 High severity
PAN-OS: Improper Validation of Syntactic Correctness of Input
A vulnerability in Palo Alto Networks PAN-OS software enables a remote attacker to reboot PAN-OS firewalls when receiving Windows New Technology LAN Manager (NTLM) packets from Windows servers. Repeated attacks eventually cause the firewall to enter maintenanc
- 9.1 Critical severity
PAN-OS: Improper Ownership Management
A vulnerability in how Palo Alto Networks PAN-OS software processes data received from Cloud Identity Engine (CIE) agents enables modification of User-ID groups. This impacts user access to network resources where users may be inappropriately denied or allowed
- 7.5 High severity
PAN-OS: Missing Release of Memory after Effective Lifetime
A memory leak exists in Palo Alto Networks PAN-OS software that enables an attacker to send a burst of crafted packets through the firewall that eventually prevents the firewall from processing traffic. This issue applies only to PA-5400 Series devices that ar
- 7.0 High severity
GlobalProtect App: Improper Privilege Management
A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race c
- 8.8 High severity
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire…
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
- 7.8 High severity
GlobalProtect App: Reliance on Untrusted Inputs in a Security Decision
A local privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows enables a local user to execute programs with elevated privileges.
- 7.8 High severity
Cortex XDR agent: Protection Mechanism Failure
A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.
- 8.1 High severity
PAN-OS: Authentication Bypass by Spoofing
An authentication bypass vulnerability in the Palo Alto Networks PAN-OS 8.1 web interface allows a network-based attacker with specific knowledge of the target firewall or Panorama appliance to impersonate an existing PAN-OS administrator and perform privilege
- 8.6 High severity
Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Exploited
A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. The DoS attack would appear to originate from a Palo Alto Networks PA-Series (hardware), VM-Series (vir
- 7.2 High severity
PAN-OS: Improper Neutralization of Special Elements
A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privile
- 7.8 High severity
GlobalProtect App: Improper Link Resolution Before File Access
An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privilege
- 7.8 High severity
GlobalProtect App: Improper Handling of Exceptional Conditions
An improper handling of exceptional conditions vulnerability exists within the Connect Before Logon feature of the Palo Alto Networks GlobalProtect app that enables a local attacker to escalate to SYSTEM or root privileges when authenticating with Connect Befo
- 7.8 High severity
Cortex XDR Agent: Uncontrolled Search Path Element
A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs with elevated privileges. This issue impacts: Cortex XDR agent 5.0 versions earlier than Cortex XDR a
- 7.3 High severity
Cortex XDR Agent: Untrusted Search Path
An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory (such as C:\) to store a program that can then be unintentionally executed by anot
- 7.1 High severity
Cortex XDR Agent: Improper Link Resolution Before File Access
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user to delete arbitrary system files and impact the system integrity or cause a denial of service conditio
- 10.0 Critical severity
Palo Alto Networks PAN-OS Authentication Bypass Exploited
When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based
- 8.1 High severity
Palo Alto Networks PAN-OS Remote Code Execution Exploited
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code.
- 7.8 High severity
Linux Kernel Integer Overflow Exploited
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x
- 9.8 Critical severity
Palo Alto Networks PAN-OS Remote Code Execution Exploited
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.
- 7.0 High severity
Linux Kernel Race Condition Exploited
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016