Search
Find a vulnerability
Search criteria
788 vulnerabilities by Palo Alto Networks
CVE-2026-0304 (GCVE-0-2026-0304)
Vulnerability from nvd – Published: 2026-09-10 06:02 – Updated: 2026-09-11 03:56
VLAI
EPSS
VEX
Title
Cortex XDR Broker VM: Privilege Escalation Vulnerability
Summary
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 00:00 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0304 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Cortex XDR Broker VM |
Affected:
20.0.96 , < 32.0.52
(custom)
cpe:2.3:a:palo_alto_networks:cortex_xdr_broker_vm:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0304",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:56:03.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cortex XDR Broker VM",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "32.0.52",
"status": "unaffected"
}
],
"lessThan": "32.0.52",
"status": "affected",
"version": "20.0.96",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue on brokers that process cloud-delivered mount actions."
}
],
"value": "No special configuration is required to be affected by this issue on brokers that process cloud-delivered mount actions."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xdr_broker_vm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "32.0.52",
"versionStartIncluding": "32.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "internal security research teams"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM."
}
],
"value": "A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:02:24.553Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0304"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eThis issue is fixed in Cortex XDR Broker VM 32.0.52, and all later Cortex XDR Broker VM versions.\u003c/span\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan\u003eIf automatic upgrades are enabled for Broker VM, then no action is required at this time.\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cb\u003e\u003c/b\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan\u003eIf automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "This issue is fixed in Cortex XDR Broker VM 32.0.52, and all later Cortex XDR Broker VM versions.\n\n * If automatic upgrades are enabled for Broker VM, then no action is required at this time.\n\n * If automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software"
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Cortex XDR Broker VM: Privilege Escalation Vulnerability",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"Cortex XDR Broker VM 32.0.0",
"Cortex XDR Broker VM 32.0.1",
"Cortex XDR Broker VM 32.0.2",
"Cortex XDR Broker VM 32.0.3",
"Cortex XDR Broker VM 32.0.4",
"Cortex XDR Broker VM 32.0.5",
"Cortex XDR Broker VM 32.0.6",
"Cortex XDR Broker VM 32.0.7",
"Cortex XDR Broker VM 32.0.8",
"Cortex XDR Broker VM 32.0.9",
"Cortex XDR Broker VM 32.0.10",
"Cortex XDR Broker VM 32.0.11",
"Cortex XDR Broker VM 32.0.12",
"Cortex XDR Broker VM 32.0.13",
"Cortex XDR Broker VM 32.0.14",
"Cortex XDR Broker VM 32.0.15",
"Cortex XDR Broker VM 32.0.16",
"Cortex XDR Broker VM 32.0.17",
"Cortex XDR Broker VM 32.0.18",
"Cortex XDR Broker VM 32.0.19",
"Cortex XDR Broker VM 32.0.20",
"Cortex XDR Broker VM 32.0.21",
"Cortex XDR Broker VM 32.0.22",
"Cortex XDR Broker VM 32.0.23",
"Cortex XDR Broker VM 32.0.24",
"Cortex XDR Broker VM 32.0.25",
"Cortex XDR Broker VM 32.0.26",
"Cortex XDR Broker VM 32.0.27",
"Cortex XDR Broker VM 32.0.28",
"Cortex XDR Broker VM 32.0.29",
"Cortex XDR Broker VM 32.0.30",
"Cortex XDR Broker VM 32.0.31",
"Cortex XDR Broker VM 32.0.32",
"Cortex XDR Broker VM 32.0.33",
"Cortex XDR Broker VM 32.0.34",
"Cortex XDR Broker VM 32.0.35",
"Cortex XDR Broker VM 32.0.36",
"Cortex XDR Broker VM 32.0.37",
"Cortex XDR Broker VM 32.0.38",
"Cortex XDR Broker VM 32.0.39",
"Cortex XDR Broker VM 32.0.40",
"Cortex XDR Broker VM 32.0.41",
"Cortex XDR Broker VM 32.0.42",
"Cortex XDR Broker VM 32.0.43",
"Cortex XDR Broker VM 32.0.44",
"Cortex XDR Broker VM 32.0.45",
"Cortex XDR Broker VM 32.0.46",
"Cortex XDR Broker VM 32.0.47",
"Cortex XDR Broker VM 32.0.48",
"Cortex XDR Broker VM 32.0.49",
"Cortex XDR Broker VM 32.0.50",
"Cortex XDR Broker VM 32.0.51"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0304",
"datePublished": "2026-09-10T06:02:24.553Z",
"dateReserved": "2025-11-03T20:45:02.858Z",
"dateUpdated": "2026-09-11T03:56:03.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0303 (GCVE-0-2026-0303)
Vulnerability from nvd – Published: 2026-09-10 06:03 – Updated: 2026-09-10 13:01
VLAI
EPSS
VEX
Title
Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File
Summary
A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:01 UTC
CWE
- CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0303 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Checkov by Prisma Cloud |
Affected:
3.2.0 , < 3.2.532
(custom)
cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0303",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:01:15.631812Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:01:27.361Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Checkov by Prisma Cloud",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "3.2.532",
"status": "unaffected"
}
],
"lessThan": "3.2.532",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eNo special configuration is required to be vulnerable to this issue.\u003c/span\u003e"
}
],
"value": "No special configuration is required to be vulnerable to this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.532",
"versionStartIncluding": "3.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Adedeji"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA code execution vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "A code execution vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\u0026nbsp;"
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 2.4,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "If the user scans infrastructure as code (IaC) files from untrusted sources."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:03:50.513Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0303"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eCheckov by Prisma Cloud 3.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e3.2.0 through 3.2.531\u003c/td\u003e\n \u003ctd\u003eUpgrade to 3.2.532or later.\u003c/td\u003e\n \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cbr\u003eCheckov integration in Prisma Cloud is upgraded automatically when new versions become available."
}
],
"value": "Version\nMinor Version\nSuggested Solution\n\n Checkov by Prisma Cloud 3.2\n\n 3.2.0 through 3.2.531\n Upgrade to 3.2.532or later.\n \nCheckov integration in Prisma Cloud is upgraded automatically when new versions become available."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory."
}
],
"value": "Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory."
}
],
"x_affectedList": [
"Checkov by Prisma Cloud 3.2.0",
"Checkov by Prisma Cloud 3.2.1",
"Checkov by Prisma Cloud 3.2.2",
"Checkov by Prisma Cloud 3.2.3",
"Checkov by Prisma Cloud 3.2.4",
"Checkov by Prisma Cloud 3.2.5",
"Checkov by Prisma Cloud 3.2.6",
"Checkov by Prisma Cloud 3.2.7",
"Checkov by Prisma Cloud 3.2.8",
"Checkov by Prisma Cloud 3.2.9",
"Checkov by Prisma Cloud 3.2.10",
"Checkov by Prisma Cloud 3.2.11",
"Checkov by Prisma Cloud 3.2.12",
"Checkov by Prisma Cloud 3.2.13",
"Checkov by Prisma Cloud 3.2.14",
"Checkov by Prisma Cloud 3.2.15",
"Checkov by Prisma Cloud 3.2.16",
"Checkov by Prisma Cloud 3.2.17",
"Checkov by Prisma Cloud 3.2.18",
"Checkov by Prisma Cloud 3.2.19",
"Checkov by Prisma Cloud 3.2.20",
"Checkov by Prisma Cloud 3.2.21",
"Checkov by Prisma Cloud 3.2.22",
"Checkov by Prisma Cloud 3.2.23",
"Checkov by Prisma Cloud 3.2.24",
"Checkov by Prisma Cloud 3.2.25",
"Checkov by Prisma Cloud 3.2.26",
"Checkov by Prisma Cloud 3.2.27",
"Checkov by Prisma Cloud 3.2.28",
"Checkov by Prisma Cloud 3.2.29",
"Checkov by Prisma Cloud 3.2.30",
"Checkov by Prisma Cloud 3.2.31",
"Checkov by Prisma Cloud 3.2.32",
"Checkov by Prisma Cloud 3.2.33",
"Checkov by Prisma Cloud 3.2.34",
"Checkov by Prisma Cloud 3.2.35",
"Checkov by Prisma Cloud 3.2.36",
"Checkov by Prisma Cloud 3.2.37",
"Checkov by Prisma Cloud 3.2.38",
"Checkov by Prisma Cloud 3.2.39",
"Checkov by Prisma Cloud 3.2.40",
"Checkov by Prisma Cloud 3.2.41",
"Checkov by Prisma Cloud 3.2.42",
"Checkov by Prisma Cloud 3.2.43",
"Checkov by Prisma Cloud 3.2.44",
"Checkov by Prisma Cloud 3.2.45",
"Checkov by Prisma Cloud 3.2.46",
"Checkov by Prisma Cloud 3.2.47",
"Checkov by Prisma Cloud 3.2.48",
"Checkov by Prisma Cloud 3.2.49",
"Checkov by Prisma Cloud 3.2.50",
"Checkov by Prisma Cloud 3.2.51",
"Checkov by Prisma Cloud 3.2.52",
"Checkov by Prisma Cloud 3.2.53",
"Checkov by Prisma Cloud 3.2.54",
"Checkov by Prisma Cloud 3.2.55",
"Checkov by Prisma Cloud 3.2.56",
"Checkov by Prisma Cloud 3.2.57",
"Checkov by Prisma Cloud 3.2.58",
"Checkov by Prisma Cloud 3.2.59",
"Checkov by Prisma Cloud 3.2.60",
"Checkov by Prisma Cloud 3.2.61",
"Checkov by Prisma Cloud 3.2.62",
"Checkov by Prisma Cloud 3.2.63",
"Checkov by Prisma Cloud 3.2.64",
"Checkov by Prisma Cloud 3.2.65",
"Checkov by Prisma Cloud 3.2.66",
"Checkov by Prisma Cloud 3.2.67",
"Checkov by Prisma Cloud 3.2.68",
"Checkov by Prisma Cloud 3.2.69",
"Checkov by Prisma Cloud 3.2.70",
"Checkov by Prisma Cloud 3.2.71",
"Checkov by Prisma Cloud 3.2.72",
"Checkov by Prisma Cloud 3.2.73",
"Checkov by Prisma Cloud 3.2.74",
"Checkov by Prisma Cloud 3.2.75",
"Checkov by Prisma Cloud 3.2.76",
"Checkov by Prisma Cloud 3.2.77",
"Checkov by Prisma Cloud 3.2.78",
"Checkov by Prisma Cloud 3.2.79",
"Checkov by Prisma Cloud 3.2.80",
"Checkov by Prisma Cloud 3.2.81",
"Checkov by Prisma Cloud 3.2.82",
"Checkov by Prisma Cloud 3.2.83",
"Checkov by Prisma Cloud 3.2.84",
"Checkov by Prisma Cloud 3.2.85",
"Checkov by Prisma Cloud 3.2.86",
"Checkov by Prisma Cloud 3.2.87",
"Checkov by Prisma Cloud 3.2.88",
"Checkov by Prisma Cloud 3.2.89",
"Checkov by Prisma Cloud 3.2.90",
"Checkov by Prisma Cloud 3.2.91",
"Checkov by Prisma Cloud 3.2.92",
"Checkov by Prisma Cloud 3.2.93",
"Checkov by Prisma Cloud 3.2.94",
"Checkov by Prisma Cloud 3.2.95",
"Checkov by Prisma Cloud 3.2.96",
"Checkov by Prisma Cloud 3.2.97",
"Checkov by Prisma Cloud 3.2.98",
"Checkov by Prisma Cloud 3.2.99",
"Checkov by Prisma Cloud 3.2.100",
"Checkov by Prisma Cloud 3.2.101",
"Checkov by Prisma Cloud 3.2.102",
"Checkov by Prisma Cloud 3.2.103",
"Checkov by Prisma Cloud 3.2.104",
"Checkov by Prisma Cloud 3.2.105",
"Checkov by Prisma Cloud 3.2.106",
"Checkov by Prisma Cloud 3.2.107",
"Checkov by Prisma Cloud 3.2.108",
"Checkov by Prisma Cloud 3.2.109",
"Checkov by Prisma Cloud 3.2.110",
"Checkov by Prisma Cloud 3.2.111",
"Checkov by Prisma Cloud 3.2.112",
"Checkov by Prisma Cloud 3.2.113",
"Checkov by Prisma Cloud 3.2.114",
"Checkov by Prisma Cloud 3.2.115",
"Checkov by Prisma Cloud 3.2.116",
"Checkov by Prisma Cloud 3.2.117",
"Checkov by Prisma Cloud 3.2.118",
"Checkov by Prisma Cloud 3.2.119",
"Checkov by Prisma Cloud 3.2.120",
"Checkov by Prisma Cloud 3.2.121",
"Checkov by Prisma Cloud 3.2.122",
"Checkov by Prisma Cloud 3.2.123",
"Checkov by Prisma Cloud 3.2.124",
"Checkov by Prisma Cloud 3.2.125",
"Checkov by Prisma Cloud 3.2.126",
"Checkov by Prisma Cloud 3.2.127",
"Checkov by Prisma Cloud 3.2.128",
"Checkov by Prisma Cloud 3.2.129",
"Checkov by Prisma Cloud 3.2.130",
"Checkov by Prisma Cloud 3.2.131",
"Checkov by Prisma Cloud 3.2.132",
"Checkov by Prisma Cloud 3.2.133",
"Checkov by Prisma Cloud 3.2.134",
"Checkov by Prisma Cloud 3.2.135",
"Checkov by Prisma Cloud 3.2.136",
"Checkov by Prisma Cloud 3.2.137",
"Checkov by Prisma Cloud 3.2.138",
"Checkov by Prisma Cloud 3.2.139",
"Checkov by Prisma Cloud 3.2.140",
"Checkov by Prisma Cloud 3.2.141",
"Checkov by Prisma Cloud 3.2.142",
"Checkov by Prisma Cloud 3.2.143",
"Checkov by Prisma Cloud 3.2.144",
"Checkov by Prisma Cloud 3.2.145",
"Checkov by Prisma Cloud 3.2.146",
"Checkov by Prisma Cloud 3.2.147",
"Checkov by Prisma Cloud 3.2.148",
"Checkov by Prisma Cloud 3.2.149",
"Checkov by Prisma Cloud 3.2.150",
"Checkov by Prisma Cloud 3.2.151",
"Checkov by Prisma Cloud 3.2.152",
"Checkov by Prisma Cloud 3.2.153",
"Checkov by Prisma Cloud 3.2.154",
"Checkov by Prisma Cloud 3.2.155",
"Checkov by Prisma Cloud 3.2.156",
"Checkov by Prisma Cloud 3.2.157",
"Checkov by Prisma Cloud 3.2.158",
"Checkov by Prisma Cloud 3.2.159",
"Checkov by Prisma Cloud 3.2.160",
"Checkov by Prisma Cloud 3.2.161",
"Checkov by Prisma Cloud 3.2.162",
"Checkov by Prisma Cloud 3.2.163",
"Checkov by Prisma Cloud 3.2.164",
"Checkov by Prisma Cloud 3.2.165",
"Checkov by Prisma Cloud 3.2.166",
"Checkov by Prisma Cloud 3.2.167",
"Checkov by Prisma Cloud 3.2.168",
"Checkov by Prisma Cloud 3.2.169",
"Checkov by Prisma Cloud 3.2.170",
"Checkov by Prisma Cloud 3.2.171",
"Checkov by Prisma Cloud 3.2.172",
"Checkov by Prisma Cloud 3.2.173",
"Checkov by Prisma Cloud 3.2.174",
"Checkov by Prisma Cloud 3.2.175",
"Checkov by Prisma Cloud 3.2.176",
"Checkov by Prisma Cloud 3.2.177",
"Checkov by Prisma Cloud 3.2.178",
"Checkov by Prisma Cloud 3.2.179",
"Checkov by Prisma Cloud 3.2.180",
"Checkov by Prisma Cloud 3.2.181",
"Checkov by Prisma Cloud 3.2.182",
"Checkov by Prisma Cloud 3.2.183",
"Checkov by Prisma Cloud 3.2.184",
"Checkov by Prisma Cloud 3.2.185",
"Checkov by Prisma Cloud 3.2.186",
"Checkov by Prisma Cloud 3.2.187",
"Checkov by Prisma Cloud 3.2.188",
"Checkov by Prisma Cloud 3.2.189",
"Checkov by Prisma Cloud 3.2.190",
"Checkov by Prisma Cloud 3.2.191",
"Checkov by Prisma Cloud 3.2.192",
"Checkov by Prisma Cloud 3.2.193",
"Checkov by Prisma Cloud 3.2.194",
"Checkov by Prisma Cloud 3.2.195",
"Checkov by Prisma Cloud 3.2.196",
"Checkov by Prisma Cloud 3.2.197",
"Checkov by Prisma Cloud 3.2.198",
"Checkov by Prisma Cloud 3.2.199",
"Checkov by Prisma Cloud 3.2.200",
"Checkov by Prisma Cloud 3.2.201",
"Checkov by Prisma Cloud 3.2.202",
"Checkov by Prisma Cloud 3.2.203",
"Checkov by Prisma Cloud 3.2.204",
"Checkov by Prisma Cloud 3.2.205",
"Checkov by Prisma Cloud 3.2.206",
"Checkov by Prisma Cloud 3.2.207",
"Checkov by Prisma Cloud 3.2.208",
"Checkov by Prisma Cloud 3.2.209",
"Checkov by Prisma Cloud 3.2.210",
"Checkov by Prisma Cloud 3.2.211",
"Checkov by Prisma Cloud 3.2.212",
"Checkov by Prisma Cloud 3.2.213",
"Checkov by Prisma Cloud 3.2.214",
"Checkov by Prisma Cloud 3.2.215",
"Checkov by Prisma Cloud 3.2.216",
"Checkov by Prisma Cloud 3.2.217",
"Checkov by Prisma Cloud 3.2.218",
"Checkov by Prisma Cloud 3.2.219",
"Checkov by Prisma Cloud 3.2.220",
"Checkov by Prisma Cloud 3.2.221",
"Checkov by Prisma Cloud 3.2.222",
"Checkov by Prisma Cloud 3.2.223",
"Checkov by Prisma Cloud 3.2.224",
"Checkov by Prisma Cloud 3.2.225",
"Checkov by Prisma Cloud 3.2.226",
"Checkov by Prisma Cloud 3.2.227",
"Checkov by Prisma Cloud 3.2.228",
"Checkov by Prisma Cloud 3.2.229",
"Checkov by Prisma Cloud 3.2.230",
"Checkov by Prisma Cloud 3.2.231",
"Checkov by Prisma Cloud 3.2.232",
"Checkov by Prisma Cloud 3.2.233",
"Checkov by Prisma Cloud 3.2.234",
"Checkov by Prisma Cloud 3.2.235",
"Checkov by Prisma Cloud 3.2.236",
"Checkov by Prisma Cloud 3.2.237",
"Checkov by Prisma Cloud 3.2.238",
"Checkov by Prisma Cloud 3.2.239",
"Checkov by Prisma Cloud 3.2.240",
"Checkov by Prisma Cloud 3.2.241",
"Checkov by Prisma Cloud 3.2.242",
"Checkov by Prisma Cloud 3.2.243",
"Checkov by Prisma Cloud 3.2.244",
"Checkov by Prisma Cloud 3.2.245",
"Checkov by Prisma Cloud 3.2.246",
"Checkov by Prisma Cloud 3.2.247",
"Checkov by Prisma Cloud 3.2.248",
"Checkov by Prisma Cloud 3.2.249",
"Checkov by Prisma Cloud 3.2.250",
"Checkov by Prisma Cloud 3.2.251",
"Checkov by Prisma Cloud 3.2.252",
"Checkov by Prisma Cloud 3.2.253",
"Checkov by Prisma Cloud 3.2.254",
"Checkov by Prisma Cloud 3.2.255",
"Checkov by Prisma Cloud 3.2.256",
"Checkov by Prisma Cloud 3.2.257",
"Checkov by Prisma Cloud 3.2.258",
"Checkov by Prisma Cloud 3.2.259",
"Checkov by Prisma Cloud 3.2.260",
"Checkov by Prisma Cloud 3.2.261",
"Checkov by Prisma Cloud 3.2.262",
"Checkov by Prisma Cloud 3.2.263",
"Checkov by Prisma Cloud 3.2.264",
"Checkov by Prisma Cloud 3.2.265",
"Checkov by Prisma Cloud 3.2.266",
"Checkov by Prisma Cloud 3.2.267",
"Checkov by Prisma Cloud 3.2.268",
"Checkov by Prisma Cloud 3.2.269",
"Checkov by Prisma Cloud 3.2.270",
"Checkov by Prisma Cloud 3.2.271",
"Checkov by Prisma Cloud 3.2.272",
"Checkov by Prisma Cloud 3.2.273",
"Checkov by Prisma Cloud 3.2.274",
"Checkov by Prisma Cloud 3.2.275",
"Checkov by Prisma Cloud 3.2.276",
"Checkov by Prisma Cloud 3.2.277",
"Checkov by Prisma Cloud 3.2.278",
"Checkov by Prisma Cloud 3.2.279",
"Checkov by Prisma Cloud 3.2.280",
"Checkov by Prisma Cloud 3.2.281",
"Checkov by Prisma Cloud 3.2.282",
"Checkov by Prisma Cloud 3.2.283",
"Checkov by Prisma Cloud 3.2.284",
"Checkov by Prisma Cloud 3.2.285",
"Checkov by Prisma Cloud 3.2.286",
"Checkov by Prisma Cloud 3.2.287",
"Checkov by Prisma Cloud 3.2.288",
"Checkov by Prisma Cloud 3.2.289",
"Checkov by Prisma Cloud 3.2.290",
"Checkov by Prisma Cloud 3.2.291",
"Checkov by Prisma Cloud 3.2.292",
"Checkov by Prisma Cloud 3.2.293",
"Checkov by Prisma Cloud 3.2.294",
"Checkov by Prisma Cloud 3.2.295",
"Checkov by Prisma Cloud 3.2.296",
"Checkov by Prisma Cloud 3.2.297",
"Checkov by Prisma Cloud 3.2.298",
"Checkov by Prisma Cloud 3.2.299",
"Checkov by Prisma Cloud 3.2.300",
"Checkov by Prisma Cloud 3.2.301",
"Checkov by Prisma Cloud 3.2.302",
"Checkov by Prisma Cloud 3.2.303",
"Checkov by Prisma Cloud 3.2.304",
"Checkov by Prisma Cloud 3.2.305",
"Checkov by Prisma Cloud 3.2.306",
"Checkov by Prisma Cloud 3.2.307",
"Checkov by Prisma Cloud 3.2.308",
"Checkov by Prisma Cloud 3.2.309",
"Checkov by Prisma Cloud 3.2.310",
"Checkov by Prisma Cloud 3.2.311",
"Checkov by Prisma Cloud 3.2.312",
"Checkov by Prisma Cloud 3.2.313",
"Checkov by Prisma Cloud 3.2.314",
"Checkov by Prisma Cloud 3.2.315",
"Checkov by Prisma Cloud 3.2.316",
"Checkov by Prisma Cloud 3.2.317",
"Checkov by Prisma Cloud 3.2.318",
"Checkov by Prisma Cloud 3.2.319",
"Checkov by Prisma Cloud 3.2.320",
"Checkov by Prisma Cloud 3.2.321",
"Checkov by Prisma Cloud 3.2.322",
"Checkov by Prisma Cloud 3.2.323",
"Checkov by Prisma Cloud 3.2.324",
"Checkov by Prisma Cloud 3.2.325",
"Checkov by Prisma Cloud 3.2.326",
"Checkov by Prisma Cloud 3.2.327",
"Checkov by Prisma Cloud 3.2.328",
"Checkov by Prisma Cloud 3.2.329",
"Checkov by Prisma Cloud 3.2.330",
"Checkov by Prisma Cloud 3.2.331",
"Checkov by Prisma Cloud 3.2.332",
"Checkov by Prisma Cloud 3.2.333",
"Checkov by Prisma Cloud 3.2.334",
"Checkov by Prisma Cloud 3.2.335",
"Checkov by Prisma Cloud 3.2.336",
"Checkov by Prisma Cloud 3.2.337",
"Checkov by Prisma Cloud 3.2.338",
"Checkov by Prisma Cloud 3.2.339",
"Checkov by Prisma Cloud 3.2.340",
"Checkov by Prisma Cloud 3.2.341",
"Checkov by Prisma Cloud 3.2.342",
"Checkov by Prisma Cloud 3.2.343",
"Checkov by Prisma Cloud 3.2.344",
"Checkov by Prisma Cloud 3.2.345",
"Checkov by Prisma Cloud 3.2.346",
"Checkov by Prisma Cloud 3.2.347",
"Checkov by Prisma Cloud 3.2.348",
"Checkov by Prisma Cloud 3.2.349",
"Checkov by Prisma Cloud 3.2.350",
"Checkov by Prisma Cloud 3.2.351",
"Checkov by Prisma Cloud 3.2.352",
"Checkov by Prisma Cloud 3.2.353",
"Checkov by Prisma Cloud 3.2.354",
"Checkov by Prisma Cloud 3.2.355",
"Checkov by Prisma Cloud 3.2.356",
"Checkov by Prisma Cloud 3.2.357",
"Checkov by Prisma Cloud 3.2.358",
"Checkov by Prisma Cloud 3.2.359",
"Checkov by Prisma Cloud 3.2.360",
"Checkov by Prisma Cloud 3.2.361",
"Checkov by Prisma Cloud 3.2.362",
"Checkov by Prisma Cloud 3.2.363",
"Checkov by Prisma Cloud 3.2.364",
"Checkov by Prisma Cloud 3.2.365",
"Checkov by Prisma Cloud 3.2.366",
"Checkov by Prisma Cloud 3.2.367",
"Checkov by Prisma Cloud 3.2.368",
"Checkov by Prisma Cloud 3.2.369",
"Checkov by Prisma Cloud 3.2.370",
"Checkov by Prisma Cloud 3.2.371",
"Checkov by Prisma Cloud 3.2.372",
"Checkov by Prisma Cloud 3.2.373",
"Checkov by Prisma Cloud 3.2.374",
"Checkov by Prisma Cloud 3.2.375",
"Checkov by Prisma Cloud 3.2.376",
"Checkov by Prisma Cloud 3.2.377",
"Checkov by Prisma Cloud 3.2.378",
"Checkov by Prisma Cloud 3.2.379",
"Checkov by Prisma Cloud 3.2.380",
"Checkov by Prisma Cloud 3.2.381",
"Checkov by Prisma Cloud 3.2.382",
"Checkov by Prisma Cloud 3.2.383",
"Checkov by Prisma Cloud 3.2.384",
"Checkov by Prisma Cloud 3.2.385",
"Checkov by Prisma Cloud 3.2.386",
"Checkov by Prisma Cloud 3.2.387",
"Checkov by Prisma Cloud 3.2.388",
"Checkov by Prisma Cloud 3.2.389",
"Checkov by Prisma Cloud 3.2.390",
"Checkov by Prisma Cloud 3.2.391",
"Checkov by Prisma Cloud 3.2.392",
"Checkov by Prisma Cloud 3.2.393",
"Checkov by Prisma Cloud 3.2.394",
"Checkov by Prisma Cloud 3.2.395",
"Checkov by Prisma Cloud 3.2.396",
"Checkov by Prisma Cloud 3.2.397",
"Checkov by Prisma Cloud 3.2.398",
"Checkov by Prisma Cloud 3.2.399",
"Checkov by Prisma Cloud 3.2.400",
"Checkov by Prisma Cloud 3.2.401",
"Checkov by Prisma Cloud 3.2.402",
"Checkov by Prisma Cloud 3.2.403",
"Checkov by Prisma Cloud 3.2.404",
"Checkov by Prisma Cloud 3.2.405",
"Checkov by Prisma Cloud 3.2.406",
"Checkov by Prisma Cloud 3.2.407",
"Checkov by Prisma Cloud 3.2.408",
"Checkov by Prisma Cloud 3.2.409",
"Checkov by Prisma Cloud 3.2.410",
"Checkov by Prisma Cloud 3.2.411",
"Checkov by Prisma Cloud 3.2.412",
"Checkov by Prisma Cloud 3.2.413",
"Checkov by Prisma Cloud 3.2.414",
"Checkov by Prisma Cloud 3.2.415",
"Checkov by Prisma Cloud 3.2.416",
"Checkov by Prisma Cloud 3.2.417",
"Checkov by Prisma Cloud 3.2.418",
"Checkov by Prisma Cloud 3.2.419",
"Checkov by Prisma Cloud 3.2.420",
"Checkov by Prisma Cloud 3.2.421",
"Checkov by Prisma Cloud 3.2.422",
"Checkov by Prisma Cloud 3.2.423",
"Checkov by Prisma Cloud 3.2.424",
"Checkov by Prisma Cloud 3.2.425",
"Checkov by Prisma Cloud 3.2.426",
"Checkov by Prisma Cloud 3.2.427",
"Checkov by Prisma Cloud 3.2.428",
"Checkov by Prisma Cloud 3.2.429",
"Checkov by Prisma Cloud 3.2.430",
"Checkov by Prisma Cloud 3.2.431",
"Checkov by Prisma Cloud 3.2.432",
"Checkov by Prisma Cloud 3.2.433",
"Checkov by Prisma Cloud 3.2.434",
"Checkov by Prisma Cloud 3.2.435",
"Checkov by Prisma Cloud 3.2.436",
"Checkov by Prisma Cloud 3.2.437",
"Checkov by Prisma Cloud 3.2.438",
"Checkov by Prisma Cloud 3.2.439",
"Checkov by Prisma Cloud 3.2.440",
"Checkov by Prisma Cloud 3.2.441",
"Checkov by Prisma Cloud 3.2.442",
"Checkov by Prisma Cloud 3.2.443",
"Checkov by Prisma Cloud 3.2.444",
"Checkov by Prisma Cloud 3.2.445",
"Checkov by Prisma Cloud 3.2.446",
"Checkov by Prisma Cloud 3.2.447",
"Checkov by Prisma Cloud 3.2.448",
"Checkov by Prisma Cloud 3.2.449",
"Checkov by Prisma Cloud 3.2.450",
"Checkov by Prisma Cloud 3.2.451",
"Checkov by Prisma Cloud 3.2.452",
"Checkov by Prisma Cloud 3.2.453",
"Checkov by Prisma Cloud 3.2.454",
"Checkov by Prisma Cloud 3.2.455",
"Checkov by Prisma Cloud 3.2.456",
"Checkov by Prisma Cloud 3.2.457",
"Checkov by Prisma Cloud 3.2.458",
"Checkov by Prisma Cloud 3.2.459",
"Checkov by Prisma Cloud 3.2.460",
"Checkov by Prisma Cloud 3.2.461",
"Checkov by Prisma Cloud 3.2.462",
"Checkov by Prisma Cloud 3.2.463",
"Checkov by Prisma Cloud 3.2.464",
"Checkov by Prisma Cloud 3.2.465",
"Checkov by Prisma Cloud 3.2.466",
"Checkov by Prisma Cloud 3.2.467",
"Checkov by Prisma Cloud 3.2.468",
"Checkov by Prisma Cloud 3.2.469",
"Checkov by Prisma Cloud 3.2.470",
"Checkov by Prisma Cloud 3.2.471",
"Checkov by Prisma Cloud 3.2.472",
"Checkov by Prisma Cloud 3.2.473",
"Checkov by Prisma Cloud 3.2.474",
"Checkov by Prisma Cloud 3.2.475",
"Checkov by Prisma Cloud 3.2.476",
"Checkov by Prisma Cloud 3.2.477",
"Checkov by Prisma Cloud 3.2.478",
"Checkov by Prisma Cloud 3.2.479",
"Checkov by Prisma Cloud 3.2.480",
"Checkov by Prisma Cloud 3.2.481",
"Checkov by Prisma Cloud 3.2.482",
"Checkov by Prisma Cloud 3.2.483",
"Checkov by Prisma Cloud 3.2.484",
"Checkov by Prisma Cloud 3.2.485",
"Checkov by Prisma Cloud 3.2.486",
"Checkov by Prisma Cloud 3.2.487",
"Checkov by Prisma Cloud 3.2.488",
"Checkov by Prisma Cloud 3.2.489",
"Checkov by Prisma Cloud 3.2.490",
"Checkov by Prisma Cloud 3.2.491",
"Checkov by Prisma Cloud 3.2.492",
"Checkov by Prisma Cloud 3.2.493",
"Checkov by Prisma Cloud 3.2.494",
"Checkov by Prisma Cloud 3.2.495",
"Checkov by Prisma Cloud 3.2.496",
"Checkov by Prisma Cloud 3.2.497",
"Checkov by Prisma Cloud 3.2.498",
"Checkov by Prisma Cloud 3.2.499",
"Checkov by Prisma Cloud 3.2.500",
"Checkov by Prisma Cloud 3.2.501",
"Checkov by Prisma Cloud 3.2.502",
"Checkov by Prisma Cloud 3.2.503",
"Checkov by Prisma Cloud 3.2.504",
"Checkov by Prisma Cloud 3.2.505",
"Checkov by Prisma Cloud 3.2.506",
"Checkov by Prisma Cloud 3.2.507",
"Checkov by Prisma Cloud 3.2.508",
"Checkov by Prisma Cloud 3.2.509",
"Checkov by Prisma Cloud 3.2.510",
"Checkov by Prisma Cloud 3.2.511",
"Checkov by Prisma Cloud 3.2.512",
"Checkov by Prisma Cloud 3.2.513",
"Checkov by Prisma Cloud 3.2.514",
"Checkov by Prisma Cloud 3.2.515",
"Checkov by Prisma Cloud 3.2.516",
"Checkov by Prisma Cloud 3.2.517",
"Checkov by Prisma Cloud 3.2.518",
"Checkov by Prisma Cloud 3.2.519",
"Checkov by Prisma Cloud 3.2.520",
"Checkov by Prisma Cloud 3.2.521",
"Checkov by Prisma Cloud 3.2.522",
"Checkov by Prisma Cloud 3.2.523",
"Checkov by Prisma Cloud 3.2.524",
"Checkov by Prisma Cloud 3.2.525",
"Checkov by Prisma Cloud 3.2.526",
"Checkov by Prisma Cloud 3.2.527",
"Checkov by Prisma Cloud 3.2.528",
"Checkov by Prisma Cloud 3.2.529",
"Checkov by Prisma Cloud 3.2.530",
"Checkov by Prisma Cloud 3.2.531"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0303",
"datePublished": "2026-09-10T06:03:50.513Z",
"dateReserved": "2025-11-03T20:45:01.388Z",
"dateUpdated": "2026-09-10T13:01:27.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0302 (GCVE-0-2026-0302)
Vulnerability from nvd – Published: 2026-09-10 06:05 – Updated: 2026-09-10 13:00
VLAI
EPSS
VEX
Title
Checkov by Prisma Cloud: OS Command Injection Vulnerability
Summary
An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0302 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Checkov by Prisma Cloud |
Affected:
3.2.0 , < 3.2.502
(custom)
cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:00:38.190667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:00:46.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Checkov by Prisma Cloud",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "3.2.502",
"status": "unaffected"
}
],
"lessThan": "3.2.502",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue.\u0026nbsp;"
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.502",
"versionStartIncluding": "3.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Gherasim"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn OS command injection vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud enables a local user to execute arbitrary commands in the processes running Checkov.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud enables a local user to execute arbitrary commands in the processes running Checkov."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\u0026nbsp;"
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 1.1,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "If the user is able to influence input consumed by a Checkov scan."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:05:20.011Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0302"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eCheckov by Prisma Cloud 3.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e3.2.0 through\u0026nbsp;3.2.501\u003c/td\u003e\n \u003ctd\u003eUpgrade to 3.2.502 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "Version\nMinor Version\nSuggested Solution\n\n Checkov by Prisma Cloud 3.2\n\n 3.2.0 through\u00a03.2.501\n Upgrade to 3.2.502 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Checkov by Prisma Cloud: OS Command Injection Vulnerability",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"Checkov by Prisma Cloud 3.2.0",
"Checkov by Prisma Cloud 3.2.1",
"Checkov by Prisma Cloud 3.2.2",
"Checkov by Prisma Cloud 3.2.3",
"Checkov by Prisma Cloud 3.2.4",
"Checkov by Prisma Cloud 3.2.5",
"Checkov by Prisma Cloud 3.2.6",
"Checkov by Prisma Cloud 3.2.7",
"Checkov by Prisma Cloud 3.2.8",
"Checkov by Prisma Cloud 3.2.9",
"Checkov by Prisma Cloud 3.2.10",
"Checkov by Prisma Cloud 3.2.11",
"Checkov by Prisma Cloud 3.2.12",
"Checkov by Prisma Cloud 3.2.13",
"Checkov by Prisma Cloud 3.2.14",
"Checkov by Prisma Cloud 3.2.15",
"Checkov by Prisma Cloud 3.2.16",
"Checkov by Prisma Cloud 3.2.17",
"Checkov by Prisma Cloud 3.2.18",
"Checkov by Prisma Cloud 3.2.19",
"Checkov by Prisma Cloud 3.2.20",
"Checkov by Prisma Cloud 3.2.21",
"Checkov by Prisma Cloud 3.2.22",
"Checkov by Prisma Cloud 3.2.23",
"Checkov by Prisma Cloud 3.2.24",
"Checkov by Prisma Cloud 3.2.25",
"Checkov by Prisma Cloud 3.2.26",
"Checkov by Prisma Cloud 3.2.27",
"Checkov by Prisma Cloud 3.2.28",
"Checkov by Prisma Cloud 3.2.29",
"Checkov by Prisma Cloud 3.2.30",
"Checkov by Prisma Cloud 3.2.31",
"Checkov by Prisma Cloud 3.2.32",
"Checkov by Prisma Cloud 3.2.33",
"Checkov by Prisma Cloud 3.2.34",
"Checkov by Prisma Cloud 3.2.35",
"Checkov by Prisma Cloud 3.2.36",
"Checkov by Prisma Cloud 3.2.37",
"Checkov by Prisma Cloud 3.2.38",
"Checkov by Prisma Cloud 3.2.39",
"Checkov by Prisma Cloud 3.2.40",
"Checkov by Prisma Cloud 3.2.41",
"Checkov by Prisma Cloud 3.2.42",
"Checkov by Prisma Cloud 3.2.43",
"Checkov by Prisma Cloud 3.2.44",
"Checkov by Prisma Cloud 3.2.45",
"Checkov by Prisma Cloud 3.2.46",
"Checkov by Prisma Cloud 3.2.47",
"Checkov by Prisma Cloud 3.2.48",
"Checkov by Prisma Cloud 3.2.49",
"Checkov by Prisma Cloud 3.2.50",
"Checkov by Prisma Cloud 3.2.51",
"Checkov by Prisma Cloud 3.2.52",
"Checkov by Prisma Cloud 3.2.53",
"Checkov by Prisma Cloud 3.2.54",
"Checkov by Prisma Cloud 3.2.55",
"Checkov by Prisma Cloud 3.2.56",
"Checkov by Prisma Cloud 3.2.57",
"Checkov by Prisma Cloud 3.2.58",
"Checkov by Prisma Cloud 3.2.59",
"Checkov by Prisma Cloud 3.2.60",
"Checkov by Prisma Cloud 3.2.61",
"Checkov by Prisma Cloud 3.2.62",
"Checkov by Prisma Cloud 3.2.63",
"Checkov by Prisma Cloud 3.2.64",
"Checkov by Prisma Cloud 3.2.65",
"Checkov by Prisma Cloud 3.2.66",
"Checkov by Prisma Cloud 3.2.67",
"Checkov by Prisma Cloud 3.2.68",
"Checkov by Prisma Cloud 3.2.69",
"Checkov by Prisma Cloud 3.2.70",
"Checkov by Prisma Cloud 3.2.71",
"Checkov by Prisma Cloud 3.2.72",
"Checkov by Prisma Cloud 3.2.73",
"Checkov by Prisma Cloud 3.2.74",
"Checkov by Prisma Cloud 3.2.75",
"Checkov by Prisma Cloud 3.2.76",
"Checkov by Prisma Cloud 3.2.77",
"Checkov by Prisma Cloud 3.2.78",
"Checkov by Prisma Cloud 3.2.79",
"Checkov by Prisma Cloud 3.2.80",
"Checkov by Prisma Cloud 3.2.81",
"Checkov by Prisma Cloud 3.2.82",
"Checkov by Prisma Cloud 3.2.83",
"Checkov by Prisma Cloud 3.2.84",
"Checkov by Prisma Cloud 3.2.85",
"Checkov by Prisma Cloud 3.2.86",
"Checkov by Prisma Cloud 3.2.87",
"Checkov by Prisma Cloud 3.2.88",
"Checkov by Prisma Cloud 3.2.89",
"Checkov by Prisma Cloud 3.2.90",
"Checkov by Prisma Cloud 3.2.91",
"Checkov by Prisma Cloud 3.2.92",
"Checkov by Prisma Cloud 3.2.93",
"Checkov by Prisma Cloud 3.2.94",
"Checkov by Prisma Cloud 3.2.95",
"Checkov by Prisma Cloud 3.2.96",
"Checkov by Prisma Cloud 3.2.97",
"Checkov by Prisma Cloud 3.2.98",
"Checkov by Prisma Cloud 3.2.99",
"Checkov by Prisma Cloud 3.2.100",
"Checkov by Prisma Cloud 3.2.101",
"Checkov by Prisma Cloud 3.2.102",
"Checkov by Prisma Cloud 3.2.103",
"Checkov by Prisma Cloud 3.2.104",
"Checkov by Prisma Cloud 3.2.105",
"Checkov by Prisma Cloud 3.2.106",
"Checkov by Prisma Cloud 3.2.107",
"Checkov by Prisma Cloud 3.2.108",
"Checkov by Prisma Cloud 3.2.109",
"Checkov by Prisma Cloud 3.2.110",
"Checkov by Prisma Cloud 3.2.111",
"Checkov by Prisma Cloud 3.2.112",
"Checkov by Prisma Cloud 3.2.113",
"Checkov by Prisma Cloud 3.2.114",
"Checkov by Prisma Cloud 3.2.115",
"Checkov by Prisma Cloud 3.2.116",
"Checkov by Prisma Cloud 3.2.117",
"Checkov by Prisma Cloud 3.2.118",
"Checkov by Prisma Cloud 3.2.119",
"Checkov by Prisma Cloud 3.2.120",
"Checkov by Prisma Cloud 3.2.121",
"Checkov by Prisma Cloud 3.2.122",
"Checkov by Prisma Cloud 3.2.123",
"Checkov by Prisma Cloud 3.2.124",
"Checkov by Prisma Cloud 3.2.125",
"Checkov by Prisma Cloud 3.2.126",
"Checkov by Prisma Cloud 3.2.127",
"Checkov by Prisma Cloud 3.2.128",
"Checkov by Prisma Cloud 3.2.129",
"Checkov by Prisma Cloud 3.2.130",
"Checkov by Prisma Cloud 3.2.131",
"Checkov by Prisma Cloud 3.2.132",
"Checkov by Prisma Cloud 3.2.133",
"Checkov by Prisma Cloud 3.2.134",
"Checkov by Prisma Cloud 3.2.135",
"Checkov by Prisma Cloud 3.2.136",
"Checkov by Prisma Cloud 3.2.137",
"Checkov by Prisma Cloud 3.2.138",
"Checkov by Prisma Cloud 3.2.139",
"Checkov by Prisma Cloud 3.2.140",
"Checkov by Prisma Cloud 3.2.141",
"Checkov by Prisma Cloud 3.2.142",
"Checkov by Prisma Cloud 3.2.143",
"Checkov by Prisma Cloud 3.2.144",
"Checkov by Prisma Cloud 3.2.145",
"Checkov by Prisma Cloud 3.2.146",
"Checkov by Prisma Cloud 3.2.147",
"Checkov by Prisma Cloud 3.2.148",
"Checkov by Prisma Cloud 3.2.149",
"Checkov by Prisma Cloud 3.2.150",
"Checkov by Prisma Cloud 3.2.151",
"Checkov by Prisma Cloud 3.2.152",
"Checkov by Prisma Cloud 3.2.153",
"Checkov by Prisma Cloud 3.2.154",
"Checkov by Prisma Cloud 3.2.155",
"Checkov by Prisma Cloud 3.2.156",
"Checkov by Prisma Cloud 3.2.157",
"Checkov by Prisma Cloud 3.2.158",
"Checkov by Prisma Cloud 3.2.159",
"Checkov by Prisma Cloud 3.2.160",
"Checkov by Prisma Cloud 3.2.161",
"Checkov by Prisma Cloud 3.2.162",
"Checkov by Prisma Cloud 3.2.163",
"Checkov by Prisma Cloud 3.2.164",
"Checkov by Prisma Cloud 3.2.165",
"Checkov by Prisma Cloud 3.2.166",
"Checkov by Prisma Cloud 3.2.167",
"Checkov by Prisma Cloud 3.2.168",
"Checkov by Prisma Cloud 3.2.169",
"Checkov by Prisma Cloud 3.2.170",
"Checkov by Prisma Cloud 3.2.171",
"Checkov by Prisma Cloud 3.2.172",
"Checkov by Prisma Cloud 3.2.173",
"Checkov by Prisma Cloud 3.2.174",
"Checkov by Prisma Cloud 3.2.175",
"Checkov by Prisma Cloud 3.2.176",
"Checkov by Prisma Cloud 3.2.177",
"Checkov by Prisma Cloud 3.2.178",
"Checkov by Prisma Cloud 3.2.179",
"Checkov by Prisma Cloud 3.2.180",
"Checkov by Prisma Cloud 3.2.181",
"Checkov by Prisma Cloud 3.2.182",
"Checkov by Prisma Cloud 3.2.183",
"Checkov by Prisma Cloud 3.2.184",
"Checkov by Prisma Cloud 3.2.185",
"Checkov by Prisma Cloud 3.2.186",
"Checkov by Prisma Cloud 3.2.187",
"Checkov by Prisma Cloud 3.2.188",
"Checkov by Prisma Cloud 3.2.189",
"Checkov by Prisma Cloud 3.2.190",
"Checkov by Prisma Cloud 3.2.191",
"Checkov by Prisma Cloud 3.2.192",
"Checkov by Prisma Cloud 3.2.193",
"Checkov by Prisma Cloud 3.2.194",
"Checkov by Prisma Cloud 3.2.195",
"Checkov by Prisma Cloud 3.2.196",
"Checkov by Prisma Cloud 3.2.197",
"Checkov by Prisma Cloud 3.2.198",
"Checkov by Prisma Cloud 3.2.199",
"Checkov by Prisma Cloud 3.2.200",
"Checkov by Prisma Cloud 3.2.201",
"Checkov by Prisma Cloud 3.2.202",
"Checkov by Prisma Cloud 3.2.203",
"Checkov by Prisma Cloud 3.2.204",
"Checkov by Prisma Cloud 3.2.205",
"Checkov by Prisma Cloud 3.2.206",
"Checkov by Prisma Cloud 3.2.207",
"Checkov by Prisma Cloud 3.2.208",
"Checkov by Prisma Cloud 3.2.209",
"Checkov by Prisma Cloud 3.2.210",
"Checkov by Prisma Cloud 3.2.211",
"Checkov by Prisma Cloud 3.2.212",
"Checkov by Prisma Cloud 3.2.213",
"Checkov by Prisma Cloud 3.2.214",
"Checkov by Prisma Cloud 3.2.215",
"Checkov by Prisma Cloud 3.2.216",
"Checkov by Prisma Cloud 3.2.217",
"Checkov by Prisma Cloud 3.2.218",
"Checkov by Prisma Cloud 3.2.219",
"Checkov by Prisma Cloud 3.2.220",
"Checkov by Prisma Cloud 3.2.221",
"Checkov by Prisma Cloud 3.2.222",
"Checkov by Prisma Cloud 3.2.223",
"Checkov by Prisma Cloud 3.2.224",
"Checkov by Prisma Cloud 3.2.225",
"Checkov by Prisma Cloud 3.2.226",
"Checkov by Prisma Cloud 3.2.227",
"Checkov by Prisma Cloud 3.2.228",
"Checkov by Prisma Cloud 3.2.229",
"Checkov by Prisma Cloud 3.2.230",
"Checkov by Prisma Cloud 3.2.231",
"Checkov by Prisma Cloud 3.2.232",
"Checkov by Prisma Cloud 3.2.233",
"Checkov by Prisma Cloud 3.2.234",
"Checkov by Prisma Cloud 3.2.235",
"Checkov by Prisma Cloud 3.2.236",
"Checkov by Prisma Cloud 3.2.237",
"Checkov by Prisma Cloud 3.2.238",
"Checkov by Prisma Cloud 3.2.239",
"Checkov by Prisma Cloud 3.2.240",
"Checkov by Prisma Cloud 3.2.241",
"Checkov by Prisma Cloud 3.2.242",
"Checkov by Prisma Cloud 3.2.243",
"Checkov by Prisma Cloud 3.2.244",
"Checkov by Prisma Cloud 3.2.245",
"Checkov by Prisma Cloud 3.2.246",
"Checkov by Prisma Cloud 3.2.247",
"Checkov by Prisma Cloud 3.2.248",
"Checkov by Prisma Cloud 3.2.249",
"Checkov by Prisma Cloud 3.2.250",
"Checkov by Prisma Cloud 3.2.251",
"Checkov by Prisma Cloud 3.2.252",
"Checkov by Prisma Cloud 3.2.253",
"Checkov by Prisma Cloud 3.2.254",
"Checkov by Prisma Cloud 3.2.255",
"Checkov by Prisma Cloud 3.2.256",
"Checkov by Prisma Cloud 3.2.257",
"Checkov by Prisma Cloud 3.2.258",
"Checkov by Prisma Cloud 3.2.259",
"Checkov by Prisma Cloud 3.2.260",
"Checkov by Prisma Cloud 3.2.261",
"Checkov by Prisma Cloud 3.2.262",
"Checkov by Prisma Cloud 3.2.263",
"Checkov by Prisma Cloud 3.2.264",
"Checkov by Prisma Cloud 3.2.265",
"Checkov by Prisma Cloud 3.2.266",
"Checkov by Prisma Cloud 3.2.267",
"Checkov by Prisma Cloud 3.2.268",
"Checkov by Prisma Cloud 3.2.269",
"Checkov by Prisma Cloud 3.2.270",
"Checkov by Prisma Cloud 3.2.271",
"Checkov by Prisma Cloud 3.2.272",
"Checkov by Prisma Cloud 3.2.273",
"Checkov by Prisma Cloud 3.2.274",
"Checkov by Prisma Cloud 3.2.275",
"Checkov by Prisma Cloud 3.2.276",
"Checkov by Prisma Cloud 3.2.277",
"Checkov by Prisma Cloud 3.2.278",
"Checkov by Prisma Cloud 3.2.279",
"Checkov by Prisma Cloud 3.2.280",
"Checkov by Prisma Cloud 3.2.281",
"Checkov by Prisma Cloud 3.2.282",
"Checkov by Prisma Cloud 3.2.283",
"Checkov by Prisma Cloud 3.2.284",
"Checkov by Prisma Cloud 3.2.285",
"Checkov by Prisma Cloud 3.2.286",
"Checkov by Prisma Cloud 3.2.287",
"Checkov by Prisma Cloud 3.2.288",
"Checkov by Prisma Cloud 3.2.289",
"Checkov by Prisma Cloud 3.2.290",
"Checkov by Prisma Cloud 3.2.291",
"Checkov by Prisma Cloud 3.2.292",
"Checkov by Prisma Cloud 3.2.293",
"Checkov by Prisma Cloud 3.2.294",
"Checkov by Prisma Cloud 3.2.295",
"Checkov by Prisma Cloud 3.2.296",
"Checkov by Prisma Cloud 3.2.297",
"Checkov by Prisma Cloud 3.2.298",
"Checkov by Prisma Cloud 3.2.299",
"Checkov by Prisma Cloud 3.2.300",
"Checkov by Prisma Cloud 3.2.301",
"Checkov by Prisma Cloud 3.2.302",
"Checkov by Prisma Cloud 3.2.303",
"Checkov by Prisma Cloud 3.2.304",
"Checkov by Prisma Cloud 3.2.305",
"Checkov by Prisma Cloud 3.2.306",
"Checkov by Prisma Cloud 3.2.307",
"Checkov by Prisma Cloud 3.2.308",
"Checkov by Prisma Cloud 3.2.309",
"Checkov by Prisma Cloud 3.2.310",
"Checkov by Prisma Cloud 3.2.311",
"Checkov by Prisma Cloud 3.2.312",
"Checkov by Prisma Cloud 3.2.313",
"Checkov by Prisma Cloud 3.2.314",
"Checkov by Prisma Cloud 3.2.315",
"Checkov by Prisma Cloud 3.2.316",
"Checkov by Prisma Cloud 3.2.317",
"Checkov by Prisma Cloud 3.2.318",
"Checkov by Prisma Cloud 3.2.319",
"Checkov by Prisma Cloud 3.2.320",
"Checkov by Prisma Cloud 3.2.321",
"Checkov by Prisma Cloud 3.2.322",
"Checkov by Prisma Cloud 3.2.323",
"Checkov by Prisma Cloud 3.2.324",
"Checkov by Prisma Cloud 3.2.325",
"Checkov by Prisma Cloud 3.2.326",
"Checkov by Prisma Cloud 3.2.327",
"Checkov by Prisma Cloud 3.2.328",
"Checkov by Prisma Cloud 3.2.329",
"Checkov by Prisma Cloud 3.2.330",
"Checkov by Prisma Cloud 3.2.331",
"Checkov by Prisma Cloud 3.2.332",
"Checkov by Prisma Cloud 3.2.333",
"Checkov by Prisma Cloud 3.2.334",
"Checkov by Prisma Cloud 3.2.335",
"Checkov by Prisma Cloud 3.2.336",
"Checkov by Prisma Cloud 3.2.337",
"Checkov by Prisma Cloud 3.2.338",
"Checkov by Prisma Cloud 3.2.339",
"Checkov by Prisma Cloud 3.2.340",
"Checkov by Prisma Cloud 3.2.341",
"Checkov by Prisma Cloud 3.2.342",
"Checkov by Prisma Cloud 3.2.343",
"Checkov by Prisma Cloud 3.2.344",
"Checkov by Prisma Cloud 3.2.345",
"Checkov by Prisma Cloud 3.2.346",
"Checkov by Prisma Cloud 3.2.347",
"Checkov by Prisma Cloud 3.2.348",
"Checkov by Prisma Cloud 3.2.349",
"Checkov by Prisma Cloud 3.2.350",
"Checkov by Prisma Cloud 3.2.351",
"Checkov by Prisma Cloud 3.2.352",
"Checkov by Prisma Cloud 3.2.353",
"Checkov by Prisma Cloud 3.2.354",
"Checkov by Prisma Cloud 3.2.355",
"Checkov by Prisma Cloud 3.2.356",
"Checkov by Prisma Cloud 3.2.357",
"Checkov by Prisma Cloud 3.2.358",
"Checkov by Prisma Cloud 3.2.359",
"Checkov by Prisma Cloud 3.2.360",
"Checkov by Prisma Cloud 3.2.361",
"Checkov by Prisma Cloud 3.2.362",
"Checkov by Prisma Cloud 3.2.363",
"Checkov by Prisma Cloud 3.2.364",
"Checkov by Prisma Cloud 3.2.365",
"Checkov by Prisma Cloud 3.2.366",
"Checkov by Prisma Cloud 3.2.367",
"Checkov by Prisma Cloud 3.2.368",
"Checkov by Prisma Cloud 3.2.369",
"Checkov by Prisma Cloud 3.2.370",
"Checkov by Prisma Cloud 3.2.371",
"Checkov by Prisma Cloud 3.2.372",
"Checkov by Prisma Cloud 3.2.373",
"Checkov by Prisma Cloud 3.2.374",
"Checkov by Prisma Cloud 3.2.375",
"Checkov by Prisma Cloud 3.2.376",
"Checkov by Prisma Cloud 3.2.377",
"Checkov by Prisma Cloud 3.2.378",
"Checkov by Prisma Cloud 3.2.379",
"Checkov by Prisma Cloud 3.2.380",
"Checkov by Prisma Cloud 3.2.381",
"Checkov by Prisma Cloud 3.2.382",
"Checkov by Prisma Cloud 3.2.383",
"Checkov by Prisma Cloud 3.2.384",
"Checkov by Prisma Cloud 3.2.385",
"Checkov by Prisma Cloud 3.2.386",
"Checkov by Prisma Cloud 3.2.387",
"Checkov by Prisma Cloud 3.2.388",
"Checkov by Prisma Cloud 3.2.389",
"Checkov by Prisma Cloud 3.2.390",
"Checkov by Prisma Cloud 3.2.391",
"Checkov by Prisma Cloud 3.2.392",
"Checkov by Prisma Cloud 3.2.393",
"Checkov by Prisma Cloud 3.2.394",
"Checkov by Prisma Cloud 3.2.395",
"Checkov by Prisma Cloud 3.2.396",
"Checkov by Prisma Cloud 3.2.397",
"Checkov by Prisma Cloud 3.2.398",
"Checkov by Prisma Cloud 3.2.399",
"Checkov by Prisma Cloud 3.2.400",
"Checkov by Prisma Cloud 3.2.401",
"Checkov by Prisma Cloud 3.2.402",
"Checkov by Prisma Cloud 3.2.403",
"Checkov by Prisma Cloud 3.2.404",
"Checkov by Prisma Cloud 3.2.405",
"Checkov by Prisma Cloud 3.2.406",
"Checkov by Prisma Cloud 3.2.407",
"Checkov by Prisma Cloud 3.2.408",
"Checkov by Prisma Cloud 3.2.409",
"Checkov by Prisma Cloud 3.2.410",
"Checkov by Prisma Cloud 3.2.411",
"Checkov by Prisma Cloud 3.2.412",
"Checkov by Prisma Cloud 3.2.413",
"Checkov by Prisma Cloud 3.2.414",
"Checkov by Prisma Cloud 3.2.415",
"Checkov by Prisma Cloud 3.2.416",
"Checkov by Prisma Cloud 3.2.417",
"Checkov by Prisma Cloud 3.2.418",
"Checkov by Prisma Cloud 3.2.419",
"Checkov by Prisma Cloud 3.2.420",
"Checkov by Prisma Cloud 3.2.421",
"Checkov by Prisma Cloud 3.2.422",
"Checkov by Prisma Cloud 3.2.423",
"Checkov by Prisma Cloud 3.2.424",
"Checkov by Prisma Cloud 3.2.425",
"Checkov by Prisma Cloud 3.2.426",
"Checkov by Prisma Cloud 3.2.427",
"Checkov by Prisma Cloud 3.2.428",
"Checkov by Prisma Cloud 3.2.429",
"Checkov by Prisma Cloud 3.2.430",
"Checkov by Prisma Cloud 3.2.431",
"Checkov by Prisma Cloud 3.2.432",
"Checkov by Prisma Cloud 3.2.433",
"Checkov by Prisma Cloud 3.2.434",
"Checkov by Prisma Cloud 3.2.435",
"Checkov by Prisma Cloud 3.2.436",
"Checkov by Prisma Cloud 3.2.437",
"Checkov by Prisma Cloud 3.2.438",
"Checkov by Prisma Cloud 3.2.439",
"Checkov by Prisma Cloud 3.2.440",
"Checkov by Prisma Cloud 3.2.441",
"Checkov by Prisma Cloud 3.2.442",
"Checkov by Prisma Cloud 3.2.443",
"Checkov by Prisma Cloud 3.2.444",
"Checkov by Prisma Cloud 3.2.445",
"Checkov by Prisma Cloud 3.2.446",
"Checkov by Prisma Cloud 3.2.447",
"Checkov by Prisma Cloud 3.2.448",
"Checkov by Prisma Cloud 3.2.449",
"Checkov by Prisma Cloud 3.2.450",
"Checkov by Prisma Cloud 3.2.451",
"Checkov by Prisma Cloud 3.2.452",
"Checkov by Prisma Cloud 3.2.453",
"Checkov by Prisma Cloud 3.2.454",
"Checkov by Prisma Cloud 3.2.455",
"Checkov by Prisma Cloud 3.2.456",
"Checkov by Prisma Cloud 3.2.457",
"Checkov by Prisma Cloud 3.2.458",
"Checkov by Prisma Cloud 3.2.459",
"Checkov by Prisma Cloud 3.2.460",
"Checkov by Prisma Cloud 3.2.461",
"Checkov by Prisma Cloud 3.2.462",
"Checkov by Prisma Cloud 3.2.463",
"Checkov by Prisma Cloud 3.2.464",
"Checkov by Prisma Cloud 3.2.465",
"Checkov by Prisma Cloud 3.2.466",
"Checkov by Prisma Cloud 3.2.467",
"Checkov by Prisma Cloud 3.2.468",
"Checkov by Prisma Cloud 3.2.469",
"Checkov by Prisma Cloud 3.2.470",
"Checkov by Prisma Cloud 3.2.471",
"Checkov by Prisma Cloud 3.2.472",
"Checkov by Prisma Cloud 3.2.473",
"Checkov by Prisma Cloud 3.2.474",
"Checkov by Prisma Cloud 3.2.475",
"Checkov by Prisma Cloud 3.2.476",
"Checkov by Prisma Cloud 3.2.477",
"Checkov by Prisma Cloud 3.2.478",
"Checkov by Prisma Cloud 3.2.479",
"Checkov by Prisma Cloud 3.2.480",
"Checkov by Prisma Cloud 3.2.481",
"Checkov by Prisma Cloud 3.2.482",
"Checkov by Prisma Cloud 3.2.483",
"Checkov by Prisma Cloud 3.2.484",
"Checkov by Prisma Cloud 3.2.485",
"Checkov by Prisma Cloud 3.2.486",
"Checkov by Prisma Cloud 3.2.487",
"Checkov by Prisma Cloud 3.2.488",
"Checkov by Prisma Cloud 3.2.489",
"Checkov by Prisma Cloud 3.2.490",
"Checkov by Prisma Cloud 3.2.491",
"Checkov by Prisma Cloud 3.2.492",
"Checkov by Prisma Cloud 3.2.493",
"Checkov by Prisma Cloud 3.2.494",
"Checkov by Prisma Cloud 3.2.495",
"Checkov by Prisma Cloud 3.2.496",
"Checkov by Prisma Cloud 3.2.497",
"Checkov by Prisma Cloud 3.2.498",
"Checkov by Prisma Cloud 3.2.499",
"Checkov by Prisma Cloud 3.2.500",
"Checkov by Prisma Cloud 3.2.501"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0302",
"datePublished": "2026-09-10T06:05:20.011Z",
"dateReserved": "2025-11-03T20:45:00.329Z",
"dateUpdated": "2026-09-10T13:00:46.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0310 (GCVE-0-2026-0310)
Vulnerability from nvd – Published: 2026-09-10 05:21 – Updated: 2026-09-11 03:56
VLAI
EPSS
VEX
Title
PAN-OS: Buffer Overflow Vulnerability via XML Processing
Summary
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls.
The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
Panorama is impacted by this vulnerability.
Severity
7.2 (High)
6.6 (Medium)
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 00:00 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0310 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW |
Affected:
All
(custom)
cpe:2.3:o:palo_alto_networks:cloud_ngfw:*:*:*:*:*:AWS:*:* cpe:2.3:o:palo_alto_networks:cloud_ngfw:*:*:*:*:*:Azure:*:* |
|
| Palo Alto Networks | PAN-OS |
Affected:
12.2.0 , < 12.2.3
(custom)
Affected: 12.1.0 , < 12.1.4-h10 (custom) Affected: 11.2.0 , < 11.2.4-h21 (custom) Affected: 11.1.0 , < 11.1.4-h36 (custom) Affected: 10.2.0 , < 10.2.7-h37 (custom) cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h30:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h28:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h26:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h33:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h29:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h33:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.17:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h39:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h37:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h31:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h30:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h24:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access |
Unaffected:
12.1.0 , < 12.1.4-h10
(custom)
Affected: 11.2.0 , < 11.2.4-h21 (custom) Affected: 10.2.0 , < 10.2.7-h37 (custom) cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0310",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:56:06.683Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"AWS",
"Azure"
],
"product": "Cloud NGFW",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h30:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h28:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h26:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h33:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h29:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h33:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.17:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h39:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h37:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h31:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h30:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h24:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "PAN-OS",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.2.3",
"status": "unaffected"
}
],
"lessThan": "12.2.3",
"status": "affected",
"version": "12.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "12.1.10",
"status": "unaffected"
},
{
"at": "12.1.7-h5",
"status": "unaffected"
},
{
"at": "12.1.4-h10",
"status": "unaffected"
}
],
"lessThan": "12.1.4-h10",
"status": "affected",
"version": "12.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.2.13-h2",
"status": "unaffected"
},
{
"at": "11.2.10-h14",
"status": "unaffected"
},
{
"at": "11.2.7-h20",
"status": "unaffected"
},
{
"at": "11.2.4-h21",
"status": "unaffected"
}
],
"lessThan": "11.2.4-h21",
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.1.16-h2",
"status": "unaffected"
},
{
"at": "11.1.13-h12",
"status": "unaffected"
},
{
"at": "11.1.10-h33",
"status": "unaffected"
},
{
"at": "11.1.7-h10",
"status": "unaffected"
},
{
"at": "11.1.6-h38",
"status": "unaffected"
},
{
"at": "11.1.4-h36",
"status": "unaffected"
}
],
"lessThan": "11.1.4-h36",
"status": "affected",
"version": "11.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "10.2.18-h10",
"status": "unaffected"
},
{
"at": "10.2.16-h10",
"status": "unaffected"
},
{
"at": "10.2.13-h24",
"status": "unaffected"
},
{
"at": "10.2.10-h40",
"status": "unaffected"
},
{
"at": "10.2.7-h37",
"status": "unaffected"
}
],
"lessThan": "10.2.7-h37",
"status": "affected",
"version": "10.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Prisma Access",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.1.7-h5",
"status": "unaffected"
}
],
"lessThan": "12.1.4-h10",
"status": "unaffected",
"version": "12.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.2.7-h20",
"status": "unaffected"
}
],
"lessThan": "11.2.4-h21",
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "10.2.10-h40",
"status": "unaffected"
}
],
"lessThan": "10.2.7-h37",
"status": "affected",
"version": "10.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:cloud_ngfw:*:*:*:*:*:AWS:*:*",
"versionStartIncluding": "all",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:cloud_ngfw:*:*:*:*:*:Azure:*:*",
"versionStartIncluding": "all",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.2.3",
"versionStartIncluding": "12.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.7-h5",
"versionStartIncluding": "12.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.4-h10",
"versionStartIncluding": "12.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.13-h2",
"versionStartIncluding": "11.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.10-h14",
"versionStartIncluding": "11.2.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.7-h20",
"versionStartIncluding": "11.2.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.4-h21",
"versionStartIncluding": "11.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.16-h2",
"versionStartIncluding": "11.1.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.13-h12",
"versionStartIncluding": "11.1.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.10-h33",
"versionStartIncluding": "11.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.7-h10",
"versionStartIncluding": "11.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.6-h38",
"versionStartIncluding": "11.1.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.4-h36",
"versionStartIncluding": "11.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.18-h10",
"versionStartIncluding": "10.2.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.16-h10",
"versionStartIncluding": "10.2.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.13-h24",
"versionStartIncluding": "10.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.10-h40",
"versionStartIncluding": "10.2.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.7-h37",
"versionStartIncluding": "10.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.7-h20",
"versionStartIncluding": "11.2.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.10-h40",
"versionStartIncluding": "10.2.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "other",
"value": "Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue."
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eA buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS\u00ae software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls.\u003c/span\u003e\u003cb\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/b\u003e\u003cspan\u003eThe security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended\u003c/span\u003e \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431\"\u003e\u003cspan\u003ebest practice deployment guidelines\u003c/span\u003e\u003c/a\u003e\u003cspan\u003e. \u003c/span\u003e\u003cb\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/b\u003e\u003cspan\u003ePanorama is impacted by this vulnerability.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS\u00ae software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls.\n\nThe security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . \n\nPanorama is impacted by this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "The risk is highest for PA-Series hardware firewalls as there is a risk of arbitrary code execution"
}
]
},
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "The risk is lower for VM-Series firewalls, as the impact is limited to a Denial of Service condition"
}
]
},
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "The risk of exploitation is lower for Prisma Access and Cloud NGFW as it requires an authenticated user and the external network access is restricted."
}
]
},
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:21:28.646Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0310"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eCloud NGFW\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eCustomers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 12.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e12.2.0 through 12.2.2\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.2.3 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 12.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.8 through 12.1.9\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.5 through 12.1.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.7-h5 or 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.2 through 12.1.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.4-h10 or 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.2\u003c/td\u003e\n \u003ctd\u003e11.2.11 through 11.2.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.13-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.8 through 11.2.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.10-h14 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.5 through 11.2.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.7-h20 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.0 through 11.2.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.4-h21 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.14 through 11.1.16-h*\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.16-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.11 through 11.1.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.13-h12 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.8 through 11.1.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.10-h33 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.7 through 11.1.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.7-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.5 through 11.1.6-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.6-h38 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.0 through 11.1.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.4-h36 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 10.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.17 through \u003cbr\u003e10.2.18-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.18-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.14 through 10.2.16-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.16-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.11 through 10.2.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.13-h24 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.8 through 10.2.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.10-h40 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.0 through 10.2.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.7-h37 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older\u003cbr\u003eunsupported\u003cbr\u003ePAN-OS versions\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access 12.1\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e12.1.2 through 12.1.*\u003c/td\u003e\u003ctd\u003e\u003cbr\u003eUpgrade to 12.1.7-h5 or later.\u003cbr\u003e\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Access 11.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.0 through 11.2*\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.7-h20 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Access 10.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.0 through 10.2.*\u003cbr\u003e \u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.10-h40 or later.\u003cbr\u003e\u003c/td\u003e\n \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cbr\u003e* See the note under Product Status for information regarding Prisma Access and Cloud NGFW upgrades."
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCloud NGFW\u00a0 Customers who prefer to upgrade can work with Palo Alto\n Networks support to schedule an on-demand software upgrade.\nPAN-OS 12.2 12.2.0 through 12.2.2 Upgrade to 12.2.3 or later.\nPAN-OS 12.1 12.1.8 through 12.1.9 Upgrade to 12.1.10 or later.\n 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h5 or 12.1.10 or later.\n 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h10 or 12.1.10 or later.\nPAN-OS 11.2 11.2.11 through 11.2.13-h* Upgrade to 11.2.13-h2 or later.\n 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h14 or later.\n 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h20 or later.\n 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h21 or later.\nPAN-OS 11.1 11.1.14 through 11.1.16-h* Upgrade to 11.1.16-h2 or later.\n 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h12 or later.\n 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h33 or later.\n 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h10 or later.\n 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h38 or later.\n 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h36 or later.\nPAN-OS 10.2 10.2.17 through Upgrade to 10.2.18-h10 or later.\n 10.2.18-h*\n 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h10 or later.\n 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h24 or later.\n 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h40 or later.\n 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h37 or later.\nAll older \u00a0 Upgrade to a supported fixed version.\nunsupported\nPAN-OS versions\nPrisma Access 12.1 12.1.2 through 12.1.* Upgrade to 12.1.7-h5 or later.\nPrisma Access 11.2 11.2.0 through 11.2* Upgrade to 11.2.7-h20 or later.\nPrisma Access 10.2 10.2.0 through 10.2.* Upgrade to 10.2.10-h40 or later.\n\n\n* See the note under Product Status for information regarding Prisma Access and Cloud NGFW upgrades."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "PAN-OS: Buffer Overflow Vulnerability via XML Processing",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"PAN-OS 12.2.2",
"PAN-OS 12.1.9",
"PAN-OS 12.1.8",
"PAN-OS 12.1.7-h3",
"PAN-OS 12.1.7-h2",
"PAN-OS 12.1.7-h1",
"PAN-OS 12.1.7",
"PAN-OS 12.1.6",
"PAN-OS 12.1.5",
"PAN-OS 12.1.4-h9",
"PAN-OS 12.1.4-h8",
"PAN-OS 12.1.4-h7",
"PAN-OS 12.1.4-h6",
"PAN-OS 12.1.4-h5",
"PAN-OS 12.1.4-h3",
"PAN-OS 12.1.4-h2",
"PAN-OS 12.1.4",
"PAN-OS 12.1.3-h3",
"PAN-OS 12.1.3-h1",
"PAN-OS 12.1.3",
"PAN-OS 12.1.2",
"PAN-OS 11.2.13-h1",
"PAN-OS 11.2.13",
"PAN-OS 11.2.12",
"PAN-OS 11.2.11",
"PAN-OS 11.2.10-h13",
"PAN-OS 11.2.10-h12",
"PAN-OS 11.2.10-h10",
"PAN-OS 11.2.10-h9",
"PAN-OS 11.2.10-h8",
"PAN-OS 11.2.10-h7",
"PAN-OS 11.2.10-h6",
"PAN-OS 11.2.10-h5",
"PAN-OS 11.2.10-h4",
"PAN-OS 11.2.10-h3",
"PAN-OS 11.2.10-h2",
"PAN-OS 11.2.10-h1",
"PAN-OS 11.2.10",
"PAN-OS 11.2.9",
"PAN-OS 11.2.8",
"PAN-OS 11.2.7-h19",
"PAN-OS 11.2.7-h18",
"PAN-OS 11.2.7-h17",
"PAN-OS 11.2.7-h16",
"PAN-OS 11.2.7-h15",
"PAN-OS 11.2.7-h14",
"PAN-OS 11.2.7-h13",
"PAN-OS 11.2.7-h12",
"PAN-OS 11.2.7-h11",
"PAN-OS 11.2.7-h10",
"PAN-OS 11.2.7-h8",
"PAN-OS 11.2.7-h7",
"PAN-OS 11.2.7-h4",
"PAN-OS 11.2.7-h3",
"PAN-OS 11.2.7-h2",
"PAN-OS 11.2.7-h1",
"PAN-OS 11.2.7",
"PAN-OS 11.2.6",
"PAN-OS 11.2.5",
"PAN-OS 11.2.4-h20",
"PAN-OS 11.2.4-h18",
"PAN-OS 11.2.4-h17",
"PAN-OS 11.2.4-h15",
"PAN-OS 11.2.4-h14",
"PAN-OS 11.2.4-h12",
"PAN-OS 11.2.4-h11",
"PAN-OS 11.2.4-h10",
"PAN-OS 11.2.4-h9",
"PAN-OS 11.2.4-h8",
"PAN-OS 11.2.4-h7",
"PAN-OS 11.2.4-h6",
"PAN-OS 11.2.4-h5",
"PAN-OS 11.2.4-h4",
"PAN-OS 11.2.4-h3",
"PAN-OS 11.2.4-h2",
"PAN-OS 11.2.4-h1",
"PAN-OS 11.2.4",
"PAN-OS 11.2.3-h5",
"PAN-OS 11.2.3-h4",
"PAN-OS 11.2.3-h3",
"PAN-OS 11.2.3-h2",
"PAN-OS 11.2.3-h1",
"PAN-OS 11.2.3",
"PAN-OS 11.2.2-h2",
"PAN-OS 11.2.2-h1",
"PAN-OS 11.2.1-h1",
"PAN-OS 11.2.1",
"PAN-OS 11.2.0-h1",
"PAN-OS 11.2.0",
"PAN-OS 11.1.16-h1",
"PAN-OS 11.1.16",
"PAN-OS 11.1.15",
"PAN-OS 11.1.14",
"PAN-OS 11.1.13-h11",
"PAN-OS 11.1.13-h10",
"PAN-OS 11.1.13-h9",
"PAN-OS 11.1.13-h8",
"PAN-OS 11.1.13-h7",
"PAN-OS 11.1.13-h6",
"PAN-OS 11.1.13-h5",
"PAN-OS 11.1.13-h3",
"PAN-OS 11.1.13-h2",
"PAN-OS 11.1.13-h1",
"PAN-OS 11.1.13",
"PAN-OS 11.1.12",
"PAN-OS 11.1.11",
"PAN-OS 11.1.10-h32",
"PAN-OS 11.1.10-h30",
"PAN-OS 11.1.10-h28",
"PAN-OS 11.1.10-h27",
"PAN-OS 11.1.10-h26",
"PAN-OS 11.1.10-h25",
"PAN-OS 11.1.10-h21",
"PAN-OS 11.1.10-h12",
"PAN-OS 11.1.10-h10",
"PAN-OS 11.1.10-h9",
"PAN-OS 11.1.10-h7",
"PAN-OS 11.1.10-h5",
"PAN-OS 11.1.10-h4",
"PAN-OS 11.1.10-h1",
"PAN-OS 11.1.10",
"PAN-OS 11.1.9",
"PAN-OS 11.1.8",
"PAN-OS 11.1.6-h36",
"PAN-OS 11.1.6-h35",
"PAN-OS 11.1.6-h34",
"PAN-OS 11.1.6-h33",
"PAN-OS 11.1.6-h32",
"PAN-OS 11.1.6-h29",
"PAN-OS 11.1.6-h25",
"PAN-OS 11.1.6-h23",
"PAN-OS 11.1.6-h22",
"PAN-OS 11.1.6-h21",
"PAN-OS 11.1.6-h20",
"PAN-OS 11.1.6-h19",
"PAN-OS 11.1.6-h18",
"PAN-OS 11.1.6-h17",
"PAN-OS 11.1.6-h14",
"PAN-OS 11.1.6-h10",
"PAN-OS 11.1.6-h7",
"PAN-OS 11.1.6-h6",
"PAN-OS 11.1.6-h4",
"PAN-OS 11.1.6-h3",
"PAN-OS 11.1.6-h2",
"PAN-OS 11.1.6-h1",
"PAN-OS 11.1.6",
"PAN-OS 11.1.5-h1",
"PAN-OS 11.1.5",
"PAN-OS 11.1.4-h35",
"PAN-OS 11.1.4-h34",
"PAN-OS 11.1.4-h33",
"PAN-OS 11.1.4-h32",
"PAN-OS 11.1.4-h27",
"PAN-OS 11.1.4-h25",
"PAN-OS 11.1.4-h18",
"PAN-OS 11.1.4-h17",
"PAN-OS 11.1.4-h15",
"PAN-OS 11.1.4-h13",
"PAN-OS 11.1.4-h12",
"PAN-OS 11.1.4-h11",
"PAN-OS 11.1.4-h10",
"PAN-OS 11.1.4-h9",
"PAN-OS 11.1.4-h8",
"PAN-OS 11.1.4-h7",
"PAN-OS 11.1.4-h6",
"PAN-OS 11.1.4-h5",
"PAN-OS 11.1.4-h4",
"PAN-OS 11.1.4-h3",
"PAN-OS 11.1.4-h2",
"PAN-OS 11.1.4-h1",
"PAN-OS 11.1.4",
"PAN-OS 11.1.3-h13",
"PAN-OS 11.1.3-h12",
"PAN-OS 11.1.3-h11",
"PAN-OS 11.1.3-h10",
"PAN-OS 11.1.3-h9",
"PAN-OS 11.1.3-h8",
"PAN-OS 11.1.3-h7",
"PAN-OS 11.1.3-h6",
"PAN-OS 11.1.3-h5",
"PAN-OS 11.1.3-h4",
"PAN-OS 11.1.3-h3",
"PAN-OS 11.1.3-h2",
"PAN-OS 11.1.3-h1",
"PAN-OS 11.1.3",
"PAN-OS 11.1.2-h18",
"PAN-OS 11.1.2-h17",
"PAN-OS 11.1.2-h16",
"PAN-OS 11.1.2-h15",
"PAN-OS 11.1.2-h14",
"PAN-OS 11.1.2-h13",
"PAN-OS 11.1.2-h12",
"PAN-OS 11.1.2-h11",
"PAN-OS 11.1.2-h10",
"PAN-OS 11.1.2-h9",
"PAN-OS 11.1.2-h8",
"PAN-OS 11.1.2-h7",
"PAN-OS 11.1.2-h6",
"PAN-OS 11.1.2-h5",
"PAN-OS 11.1.2-h4",
"PAN-OS 11.1.2-h3",
"PAN-OS 11.1.2-h2",
"PAN-OS 11.1.2-h1",
"PAN-OS 11.1.2",
"PAN-OS 11.1.1-h2",
"PAN-OS 11.1.1-h1",
"PAN-OS 11.1.1",
"PAN-OS 11.1.0-h4",
"PAN-OS 11.1.0-h3",
"PAN-OS 11.1.0-h2",
"PAN-OS 11.1.0-h1",
"PAN-OS 11.1.0",
"PAN-OS 10.2.18-h9",
"PAN-OS 10.2.18-h8",
"PAN-OS 10.2.18-h7",
"PAN-OS 10.2.18-h6",
"PAN-OS 10.2.18-h5",
"PAN-OS 10.2.18-h1",
"PAN-OS 10.2.18",
"PAN-OS 10.2.17",
"PAN-OS 10.2.16-h9",
"PAN-OS 10.2.16-h8",
"PAN-OS 10.2.16-h7",
"PAN-OS 10.2.16-h6",
"PAN-OS 10.2.16-h4",
"PAN-OS 10.2.16-h1",
"PAN-OS 10.2.16",
"PAN-OS 10.2.15",
"PAN-OS 10.2.14-h1",
"PAN-OS 10.2.14",
"PAN-OS 10.2.13-h23",
"PAN-OS 10.2.13-h22",
"PAN-OS 10.2.13-h21",
"PAN-OS 10.2.13-h18",
"PAN-OS 10.2.13-h16",
"PAN-OS 10.2.13-h15",
"PAN-OS 10.2.13-h10",
"PAN-OS 10.2.13-h7",
"PAN-OS 10.2.13-h5",
"PAN-OS 10.2.13-h4",
"PAN-OS 10.2.13-h3",
"PAN-OS 10.2.13-h2",
"PAN-OS 10.2.13-h1",
"PAN-OS 10.2.13",
"PAN-OS 10.2.12-h6",
"PAN-OS 10.2.12-h5",
"PAN-OS 10.2.12-h4",
"PAN-OS 10.2.12-h3",
"PAN-OS 10.2.12-h2",
"PAN-OS 10.2.12-h1",
"PAN-OS 10.2.12",
"PAN-OS 10.2.11-h13",
"PAN-OS 10.2.11-h12",
"PAN-OS 10.2.11-h11",
"PAN-OS 10.2.11-h10",
"PAN-OS 10.2.11-h9",
"PAN-OS 10.2.11-h8",
"PAN-OS 10.2.11-h7",
"PAN-OS 10.2.11-h6",
"PAN-OS 10.2.11-h5",
"PAN-OS 10.2.11-h4",
"PAN-OS 10.2.11-h3",
"PAN-OS 10.2.11-h2",
"PAN-OS 10.2.11-h1",
"PAN-OS 10.2.11",
"PAN-OS 10.2.10-h39",
"PAN-OS 10.2.10-h37",
"PAN-OS 10.2.10-h36",
"PAN-OS 10.2.10-h31",
"PAN-OS 10.2.10-h30",
"PAN-OS 10.2.10-h27",
"PAN-OS 10.2.10-h26",
"PAN-OS 10.2.10-h23",
"PAN-OS 10.2.10-h21",
"PAN-OS 10.2.10-h18",
"PAN-OS 10.2.10-h17",
"PAN-OS 10.2.10-h14",
"PAN-OS 10.2.10-h13",
"PAN-OS 10.2.10-h12",
"PAN-OS 10.2.10-h11",
"PAN-OS 10.2.10-h10",
"PAN-OS 10.2.10-h9",
"PAN-OS 10.2.10-h8",
"PAN-OS 10.2.10-h7",
"PAN-OS 10.2.10-h6",
"PAN-OS 10.2.10-h5",
"PAN-OS 10.2.10-h4",
"PAN-OS 10.2.10-h3",
"PAN-OS 10.2.10-h2",
"PAN-OS 10.2.10-h1",
"PAN-OS 10.2.10",
"PAN-OS 10.2.9-h21",
"PAN-OS 10.2.9-h20",
"PAN-OS 10.2.9-h19",
"PAN-OS 10.2.9-h18",
"PAN-OS 10.2.9-h17",
"PAN-OS 10.2.9-h16",
"PAN-OS 10.2.9-h15",
"PAN-OS 10.2.9-h14",
"PAN-OS 10.2.9-h13",
"PAN-OS 10.2.9-h12",
"PAN-OS 10.2.9-h11",
"PAN-OS 10.2.9-h10",
"PAN-OS 10.2.9-h9",
"PAN-OS 10.2.9-h8",
"PAN-OS 10.2.9-h7",
"PAN-OS 10.2.9-h6",
"PAN-OS 10.2.9-h5",
"PAN-OS 10.2.9-h4",
"PAN-OS 10.2.9-h3",
"PAN-OS 10.2.9-h2",
"PAN-OS 10.2.9-h1",
"PAN-OS 10.2.9",
"PAN-OS 10.2.8-h21",
"PAN-OS 10.2.8-h20",
"PAN-OS 10.2.8-h19",
"PAN-OS 10.2.8-h18",
"PAN-OS 10.2.8-h17",
"PAN-OS 10.2.8-h16",
"PAN-OS 10.2.8-h15",
"PAN-OS 10.2.8-h14",
"PAN-OS 10.2.8-h13",
"PAN-OS 10.2.8-h12",
"PAN-OS 10.2.8-h11",
"PAN-OS 10.2.8-h10",
"PAN-OS 10.2.8-h9",
"PAN-OS 10.2.8-h8",
"PAN-OS 10.2.8-h7",
"PAN-OS 10.2.8-h6",
"PAN-OS 10.2.8-h5",
"PAN-OS 10.2.8-h4",
"PAN-OS 10.2.8-h3",
"PAN-OS 10.2.8-h2",
"PAN-OS 10.2.8-h1",
"PAN-OS 10.2.8",
"PAN-OS 10.2.7-h36",
"PAN-OS 10.2.7-h35",
"PAN-OS 10.2.7-h34",
"PAN-OS 10.2.7-h32",
"PAN-OS 10.2.7-h24",
"PAN-OS 10.2.7-h23",
"PAN-OS 10.2.7-h22",
"PAN-OS 10.2.7-h21",
"PAN-OS 10.2.7-h20",
"PAN-OS 10.2.7-h19",
"PAN-OS 10.2.7-h18",
"PAN-OS 10.2.7-h17",
"PAN-OS 10.2.7-h16",
"PAN-OS 10.2.7-h15",
"PAN-OS 10.2.7-h14",
"PAN-OS 10.2.7-h13",
"PAN-OS 10.2.7-h12",
"PAN-OS 10.2.7-h11",
"PAN-OS 10.2.7-h10",
"PAN-OS 10.2.7-h9",
"PAN-OS 10.2.7-h8",
"PAN-OS 10.2.7-h7",
"PAN-OS 10.2.7-h6",
"PAN-OS 10.2.7-h5",
"PAN-OS 10.2.7-h4",
"PAN-OS 10.2.7-h3",
"PAN-OS 10.2.7-h2",
"PAN-OS 10.2.7-h1",
"PAN-OS 10.2.7",
"PAN-OS 10.2.6-h6",
"PAN-OS 10.2.6-h5",
"PAN-OS 10.2.6-h4",
"PAN-OS 10.2.6-h3",
"PAN-OS 10.2.6-h2",
"PAN-OS 10.2.6-h1",
"PAN-OS 10.2.6",
"PAN-OS 10.2.5-h9",
"PAN-OS 10.2.5-h8",
"PAN-OS 10.2.5-h7",
"PAN-OS 10.2.5-h6",
"PAN-OS 10.2.5-h5",
"PAN-OS 10.2.5-h4",
"PAN-OS 10.2.5-h3",
"PAN-OS 10.2.5-h2",
"PAN-OS 10.2.5-h1",
"PAN-OS 10.2.5",
"PAN-OS 10.2.4-h32",
"PAN-OS 10.2.4-h31",
"PAN-OS 10.2.4-h30",
"PAN-OS 10.2.4-h29",
"PAN-OS 10.2.4-h28",
"PAN-OS 10.2.4-h27",
"PAN-OS 10.2.4-h26",
"PAN-OS 10.2.4-h25",
"PAN-OS 10.2.4-h24",
"PAN-OS 10.2.4-h23",
"PAN-OS 10.2.4-h22",
"PAN-OS 10.2.4-h21",
"PAN-OS 10.2.4-h20",
"PAN-OS 10.2.4-h19",
"PAN-OS 10.2.4-h18",
"PAN-OS 10.2.4-h17",
"PAN-OS 10.2.4-h16",
"PAN-OS 10.2.4-h15",
"PAN-OS 10.2.4-h14",
"PAN-OS 10.2.4-h13",
"PAN-OS 10.2.4-h12",
"PAN-OS 10.2.4-h11",
"PAN-OS 10.2.4-h10",
"PAN-OS 10.2.4-h9",
"PAN-OS 10.2.4-h8",
"PAN-OS 10.2.4-h7",
"PAN-OS 10.2.4-h6",
"PAN-OS 10.2.4-h5",
"PAN-OS 10.2.4-h4",
"PAN-OS 10.2.4-h3",
"PAN-OS 10.2.4-h2",
"PAN-OS 10.2.4-h1",
"PAN-OS 10.2.4",
"PAN-OS 10.2.3-h14",
"PAN-OS 10.2.3-h13",
"PAN-OS 10.2.3-h12",
"PAN-OS 10.2.3-h11",
"PAN-OS 10.2.3-h10",
"PAN-OS 10.2.3-h9",
"PAN-OS 10.2.3-h8",
"PAN-OS 10.2.3-h7",
"PAN-OS 10.2.3-h6",
"PAN-OS 10.2.3-h5",
"PAN-OS 10.2.3-h4",
"PAN-OS 10.2.3-h3",
"PAN-OS 10.2.3-h2",
"PAN-OS 10.2.3-h1",
"PAN-OS 10.2.3",
"PAN-OS 10.2.2-h6",
"PAN-OS 10.2.2-h5",
"PAN-OS 10.2.2-h4",
"PAN-OS 10.2.2-h3",
"PAN-OS 10.2.2-h2",
"PAN-OS 10.2.2-h1",
"PAN-OS 10.2.2",
"PAN-OS 10.2.1-h3",
"PAN-OS 10.2.1-h2",
"PAN-OS 10.2.1-h1",
"PAN-OS 10.2.1",
"PAN-OS 10.2.0-h4",
"PAN-OS 10.2.0-h3",
"PAN-OS 10.2.0-h2",
"PAN-OS 10.2.0-h1",
"PAN-OS 10.2.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0310",
"datePublished": "2026-09-10T05:21:28.646Z",
"dateReserved": "2025-11-03T20:45:08.930Z",
"dateUpdated": "2026-09-11T03:56:06.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0309 (GCVE-0-2026-0309)
Vulnerability from nvd – Published: 2026-09-10 05:44 – Updated: 2026-09-11 03:56
VLAI
EPSS
VEX
Title
PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration
Summary
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM).
The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.
Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0309 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW |
Unaffected:
All
(custom)
|
|
| Palo Alto Networks | PAN-OS |
Affected:
12.2.0 , < 12.2.3
(custom)
Affected: 12.1.0 , < 12.1.4-h10 (custom) Affected: 11.2.0 , < 11.2.4-h21 (custom) Affected: 11.1.0 , < 11.1.4-h36 (custom) Affected: 10.2.0 , < 10.2.7-h37 (custom) cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h30:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h28:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h26:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h33:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h29:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h33:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.17:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h39:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h37:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h31:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h30:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h24:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access |
Unaffected:
All , < 12.1.4-h10
(custom)
|
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0309",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:56:05.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud NGFW",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h30:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h28:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h26:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h33:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h29:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h33:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.17:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h39:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h37:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h31:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h30:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h24:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "PAN-OS",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.2.3",
"status": "unaffected"
}
],
"lessThan": "12.2.3",
"status": "affected",
"version": "12.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "12.1.10",
"status": "unaffected"
},
{
"at": "12.1.7-h5",
"status": "unaffected"
},
{
"at": "12.1.4-h10",
"status": "unaffected"
}
],
"lessThan": "12.1.4-h10",
"status": "affected",
"version": "12.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.2.13-h2",
"status": "unaffected"
},
{
"at": "11.2.10-h14",
"status": "unaffected"
},
{
"at": "11.2.7-h20",
"status": "unaffected"
},
{
"at": "11.2.4-h21",
"status": "unaffected"
}
],
"lessThan": "11.2.4-h21",
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.1.16-h2",
"status": "unaffected"
},
{
"at": "11.1.13-h12",
"status": "unaffected"
},
{
"at": "11.1.10-h33",
"status": "unaffected"
},
{
"at": "11.1.7-h10",
"status": "unaffected"
},
{
"at": "11.1.6-h38",
"status": "unaffected"
},
{
"at": "11.1.4-h36",
"status": "unaffected"
}
],
"lessThan": "11.1.4-h36",
"status": "affected",
"version": "11.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "10.2.18-h10",
"status": "unaffected"
},
{
"at": "10.2.16-h10",
"status": "unaffected"
},
{
"at": "10.2.13-h24",
"status": "unaffected"
},
{
"at": "10.2.10-h40",
"status": "unaffected"
},
{
"at": "10.2.7-h37",
"status": "unaffected"
}
],
"lessThan": "10.2.7-h37",
"status": "affected",
"version": "10.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Prisma Access",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.1.7-h5",
"status": "unaffected"
}
],
"lessThan": "12.1.4-h10",
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis issue is only applicable to PAN-OS firewalls configured with a \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/secure-keys-with-hardware-security-module/set-up-connectivity-with-hsm-pan-os/set-up-connectivity-with-safenet-network-hsm\"\u003eLuna Hardware Security Module (HSM)\u003c/a\u003e.\u003cbr\u003eTo check if a PAN-OS device has Luna Hardware Security Module (HSM) configured:\u003c/p\u003e\u003col\u003e\u003cli\u003eLog in to the firewall web interface.\u003c/li\u003e\u003cli\u003eNavigate to Device \u0026gt; Setup \u0026gt; HSM.\u003c/li\u003e\u003cli\u003eCheck the Setup Hardware Security Module section:\u003cbr\u003eIf HSM setting fields are displayed your device is affected.\u003c/li\u003e\u003c/ol\u003e"
}
],
"value": "This issue is only applicable to PAN-OS firewalls configured with a Luna Hardware Security Module (HSM) https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/secure-keys-with-hardware-security-module/set-up-connectivity-with-hsm-pan-os/set-up-connectivity-with-safenet-network-hsm .\nTo check if a PAN-OS device has Luna Hardware Security Module (HSM) configured:\n\n * Log in to the firewall web interface.\n * Navigate to Device \u003e Setup \u003e HSM.\n * Check the Setup Hardware Security Module section:\nIf HSM setting fields are displayed your device is affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.2.3",
"versionStartIncluding": "12.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.7-h5",
"versionStartIncluding": "12.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.4-h10",
"versionStartIncluding": "12.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.13-h2",
"versionStartIncluding": "11.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.10-h14",
"versionStartIncluding": "11.2.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.7-h20",
"versionStartIncluding": "11.2.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.4-h21",
"versionStartIncluding": "11.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.16-h2",
"versionStartIncluding": "11.1.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.13-h12",
"versionStartIncluding": "11.1.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.10-h33",
"versionStartIncluding": "11.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.7-h10",
"versionStartIncluding": "11.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.6-h38",
"versionStartIncluding": "11.1.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.4-h36",
"versionStartIncluding": "11.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.18-h10",
"versionStartIncluding": "10.2.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.16-h10",
"versionStartIncluding": "10.2.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.13-h24",
"versionStartIncluding": "10.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.10-h40",
"versionStartIncluding": "10.2.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.7-h37",
"versionStartIncluding": "10.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Fran\u00e7ois Rigault"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A command injection vulnerability in Palo Alto Networks PAN-OS\u00ae software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). \u003cbr\u003e\u003cbr\u003eThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.\u003cbr\u003e\u003cbr\u003ePanorama, Cloud NGFW, and Prisma\u00ae Access are not impacted by this vulnerability."
}
],
"value": "A command injection vulnerability in Palo Alto Networks PAN-OS\u00ae software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). \n\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.\n\nPanorama, Cloud NGFW, and Prisma\u00ae Access are not impacted by this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:44:10.148Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0309"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eCloud NGFW\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 12.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e12.2.0 through 12.2.2\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.2.3 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 12.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.8 through 12.1.9\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.5 through 12.1.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.7-h5 or 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.2 through 12.1.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.4-h10 or 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.2\u003c/td\u003e\n \u003ctd\u003e11.2.11 through 11.2.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.13-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.8 through 11.2.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.10-h14 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.5 through 11.2.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.7-h20 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.0 through 11.2.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.4-h21 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.14 through 11.1.16-h*\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003eUpgrade or 11.1.16-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.11 through 11.1.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.13-h12 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.8 through 11.1.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.10-h33\u0026nbsp; or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.7 through 11.1.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.7-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.5 through 11.1.6-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.6-h38 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.0 through 11.1.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.4-h36 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 10.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.17 through \u003cbr\u003e10.2.18-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.18-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.14 through 10.2.16-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.16-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.11 through 10.2.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.13-h24 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.8 through 10.2.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.10-h40 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.0 through 10.2.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.7-h37 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older\u003cbr\u003eunsupported\u003cbr\u003ePAN-OS versions\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access\u0026nbsp;\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "Version\nMinor Version\nSuggested Solution\nCloud NGFW\u00a0No action needed.\n PAN-OS 12.2\n\n 12.2.0 through 12.2.2\n Upgrade to 12.2.3 or later.\n \n PAN-OS 12.1\n\n 12.1.8 through 12.1.9\n Upgrade to 12.1.10 or later.\n \n \n 12.1.5 through 12.1.7-h*\n Upgrade to 12.1.7-h5 or 12.1.10 or later.\n \n \n 12.1.2 through 12.1.4-h*\n Upgrade to 12.1.4-h10 or 12.1.10 or later.\n \n PAN-OS 11.2\n 11.2.11 through 11.2.13-h*\n Upgrade to 11.2.13-h2 or later.\n \n \n 11.2.8 through 11.2.10-h*\n Upgrade to 11.2.10-h14 or later.\n \n \n 11.2.5 through 11.2.7-h*\n Upgrade to 11.2.7-h20 or later.\n \n \n 11.2.0 through 11.2.4-h*\n Upgrade to 11.2.4-h21 or later.\n \n PAN-OS 11.1\n\n 11.1.14 through 11.1.16-h*\n\n Upgrade or 11.1.16-h2 or later.\n \n \n 11.1.11 through 11.1.13-h*\n Upgrade to 11.1.13-h12 or later.\n \n \n 11.1.8 through 11.1.10-h*\n Upgrade to 11.1.10-h33\u00a0 or later.\n \n \n 11.1.7 through 11.1.7-h*\n Upgrade to 11.1.7-h10 or later.\n \n \n 11.1.5 through 11.1.6-h*\n Upgrade to 11.1.6-h38 or later.\n \n \n 11.1.0 through 11.1.4-h*\n Upgrade to 11.1.4-h36 or later.\n \n PAN-OS 10.2\n\n 10.2.17 through \n10.2.18-h*\n Upgrade to 10.2.18-h10 or later.\n \n \n 10.2.14 through 10.2.16-h*\n Upgrade to 10.2.16-h10 or later.\n \n \n 10.2.11 through 10.2.13-h*\n Upgrade to 10.2.13-h24 or later.\n \n \n 10.2.8 through 10.2.10-h*\n Upgrade to 10.2.10-h40 or later.\n \n \n 10.2.0 through 10.2.7-h*\n Upgrade to 10.2.7-h37 or later.\n All older\nunsupported\nPAN-OS versions\u00a0Upgrade to a supported fixed version.Prisma Access\u00a0\nNo action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"PAN-OS 12.2.2",
"PAN-OS 12.1.9",
"PAN-OS 12.1.8",
"PAN-OS 12.1.7-h3",
"PAN-OS 12.1.7-h2",
"PAN-OS 12.1.7-h1",
"PAN-OS 12.1.7",
"PAN-OS 12.1.6",
"PAN-OS 12.1.5",
"PAN-OS 12.1.4-h9",
"PAN-OS 12.1.4-h8",
"PAN-OS 12.1.4-h7",
"PAN-OS 12.1.4-h6",
"PAN-OS 12.1.4-h5",
"PAN-OS 12.1.4-h3",
"PAN-OS 12.1.4-h2",
"PAN-OS 12.1.4",
"PAN-OS 12.1.3-h3",
"PAN-OS 12.1.3-h1",
"PAN-OS 12.1.3",
"PAN-OS 12.1.2",
"PAN-OS 11.2.13-h1",
"PAN-OS 11.2.13",
"PAN-OS 11.2.12",
"PAN-OS 11.2.11",
"PAN-OS 11.2.10-h13",
"PAN-OS 11.2.10-h12",
"PAN-OS 11.2.10-h10",
"PAN-OS 11.2.10-h9",
"PAN-OS 11.2.10-h8",
"PAN-OS 11.2.10-h7",
"PAN-OS 11.2.10-h6",
"PAN-OS 11.2.10-h5",
"PAN-OS 11.2.10-h4",
"PAN-OS 11.2.10-h3",
"PAN-OS 11.2.10-h2",
"PAN-OS 11.2.10-h1",
"PAN-OS 11.2.10",
"PAN-OS 11.2.9",
"PAN-OS 11.2.8",
"PAN-OS 11.2.7-h19",
"PAN-OS 11.2.7-h18",
"PAN-OS 11.2.7-h17",
"PAN-OS 11.2.7-h16",
"PAN-OS 11.2.7-h15",
"PAN-OS 11.2.7-h14",
"PAN-OS 11.2.7-h13",
"PAN-OS 11.2.7-h12",
"PAN-OS 11.2.7-h11",
"PAN-OS 11.2.7-h10",
"PAN-OS 11.2.7-h8",
"PAN-OS 11.2.7-h7",
"PAN-OS 11.2.7-h4",
"PAN-OS 11.2.7-h3",
"PAN-OS 11.2.7-h2",
"PAN-OS 11.2.7-h1",
"PAN-OS 11.2.7",
"PAN-OS 11.2.6",
"PAN-OS 11.2.5",
"PAN-OS 11.2.4-h20",
"PAN-OS 11.2.4-h18",
"PAN-OS 11.2.4-h17",
"PAN-OS 11.2.4-h15",
"PAN-OS 11.2.4-h14",
"PAN-OS 11.2.4-h12",
"PAN-OS 11.2.4-h11",
"PAN-OS 11.2.4-h10",
"PAN-OS 11.2.4-h9",
"PAN-OS 11.2.4-h8",
"PAN-OS 11.2.4-h7",
"PAN-OS 11.2.4-h6",
"PAN-OS 11.2.4-h5",
"PAN-OS 11.2.4-h4",
"PAN-OS 11.2.4-h3",
"PAN-OS 11.2.4-h2",
"PAN-OS 11.2.4-h1",
"PAN-OS 11.2.4",
"PAN-OS 11.2.3-h5",
"PAN-OS 11.2.3-h4",
"PAN-OS 11.2.3-h3",
"PAN-OS 11.2.3-h2",
"PAN-OS 11.2.3-h1",
"PAN-OS 11.2.3",
"PAN-OS 11.2.2-h2",
"PAN-OS 11.2.2-h1",
"PAN-OS 11.2.1-h1",
"PAN-OS 11.2.1",
"PAN-OS 11.2.0-h1",
"PAN-OS 11.2.0",
"PAN-OS 11.1.16-h1",
"PAN-OS 11.1.16",
"PAN-OS 11.1.15",
"PAN-OS 11.1.14",
"PAN-OS 11.1.13-h11",
"PAN-OS 11.1.13-h10",
"PAN-OS 11.1.13-h9",
"PAN-OS 11.1.13-h8",
"PAN-OS 11.1.13-h7",
"PAN-OS 11.1.13-h6",
"PAN-OS 11.1.13-h5",
"PAN-OS 11.1.13-h3",
"PAN-OS 11.1.13-h2",
"PAN-OS 11.1.13-h1",
"PAN-OS 11.1.13",
"PAN-OS 11.1.12",
"PAN-OS 11.1.11",
"PAN-OS 11.1.10-h32",
"PAN-OS 11.1.10-h30",
"PAN-OS 11.1.10-h28",
"PAN-OS 11.1.10-h27",
"PAN-OS 11.1.10-h26",
"PAN-OS 11.1.10-h25",
"PAN-OS 11.1.10-h21",
"PAN-OS 11.1.10-h12",
"PAN-OS 11.1.10-h10",
"PAN-OS 11.1.10-h9",
"PAN-OS 11.1.10-h7",
"PAN-OS 11.1.10-h5",
"PAN-OS 11.1.10-h4",
"PAN-OS 11.1.10-h1",
"PAN-OS 11.1.10",
"PAN-OS 11.1.9",
"PAN-OS 11.1.8",
"PAN-OS 11.1.6-h36",
"PAN-OS 11.1.6-h35",
"PAN-OS 11.1.6-h34",
"PAN-OS 11.1.6-h33",
"PAN-OS 11.1.6-h32",
"PAN-OS 11.1.6-h29",
"PAN-OS 11.1.6-h25",
"PAN-OS 11.1.6-h23",
"PAN-OS 11.1.6-h22",
"PAN-OS 11.1.6-h21",
"PAN-OS 11.1.6-h20",
"PAN-OS 11.1.6-h19",
"PAN-OS 11.1.6-h18",
"PAN-OS 11.1.6-h17",
"PAN-OS 11.1.6-h14",
"PAN-OS 11.1.6-h10",
"PAN-OS 11.1.6-h7",
"PAN-OS 11.1.6-h6",
"PAN-OS 11.1.6-h4",
"PAN-OS 11.1.6-h3",
"PAN-OS 11.1.6-h2",
"PAN-OS 11.1.6-h1",
"PAN-OS 11.1.6",
"PAN-OS 11.1.5-h1",
"PAN-OS 11.1.5",
"PAN-OS 11.1.4-h35",
"PAN-OS 11.1.4-h34",
"PAN-OS 11.1.4-h33",
"PAN-OS 11.1.4-h32",
"PAN-OS 11.1.4-h27",
"PAN-OS 11.1.4-h25",
"PAN-OS 11.1.4-h18",
"PAN-OS 11.1.4-h17",
"PAN-OS 11.1.4-h15",
"PAN-OS 11.1.4-h13",
"PAN-OS 11.1.4-h12",
"PAN-OS 11.1.4-h11",
"PAN-OS 11.1.4-h10",
"PAN-OS 11.1.4-h9",
"PAN-OS 11.1.4-h8",
"PAN-OS 11.1.4-h7",
"PAN-OS 11.1.4-h6",
"PAN-OS 11.1.4-h5",
"PAN-OS 11.1.4-h4",
"PAN-OS 11.1.4-h3",
"PAN-OS 11.1.4-h2",
"PAN-OS 11.1.4-h1",
"PAN-OS 11.1.4",
"PAN-OS 11.1.3-h13",
"PAN-OS 11.1.3-h12",
"PAN-OS 11.1.3-h11",
"PAN-OS 11.1.3-h10",
"PAN-OS 11.1.3-h9",
"PAN-OS 11.1.3-h8",
"PAN-OS 11.1.3-h7",
"PAN-OS 11.1.3-h6",
"PAN-OS 11.1.3-h5",
"PAN-OS 11.1.3-h4",
"PAN-OS 11.1.3-h3",
"PAN-OS 11.1.3-h2",
"PAN-OS 11.1.3-h1",
"PAN-OS 11.1.3",
"PAN-OS 11.1.2-h18",
"PAN-OS 11.1.2-h17",
"PAN-OS 11.1.2-h16",
"PAN-OS 11.1.2-h15",
"PAN-OS 11.1.2-h14",
"PAN-OS 11.1.2-h13",
"PAN-OS 11.1.2-h12",
"PAN-OS 11.1.2-h11",
"PAN-OS 11.1.2-h10",
"PAN-OS 11.1.2-h9",
"PAN-OS 11.1.2-h8",
"PAN-OS 11.1.2-h7",
"PAN-OS 11.1.2-h6",
"PAN-OS 11.1.2-h5",
"PAN-OS 11.1.2-h4",
"PAN-OS 11.1.2-h3",
"PAN-OS 11.1.2-h2",
"PAN-OS 11.1.2-h1",
"PAN-OS 11.1.2",
"PAN-OS 11.1.1-h2",
"PAN-OS 11.1.1-h1",
"PAN-OS 11.1.1",
"PAN-OS 11.1.0-h4",
"PAN-OS 11.1.0-h3",
"PAN-OS 11.1.0-h2",
"PAN-OS 11.1.0-h1",
"PAN-OS 11.1.0",
"PAN-OS 10.2.18-h9",
"PAN-OS 10.2.18-h8",
"PAN-OS 10.2.18-h7",
"PAN-OS 10.2.18-h6",
"PAN-OS 10.2.18-h5",
"PAN-OS 10.2.18-h1",
"PAN-OS 10.2.18",
"PAN-OS 10.2.17",
"PAN-OS 10.2.16-h9",
"PAN-OS 10.2.16-h8",
"PAN-OS 10.2.16-h7",
"PAN-OS 10.2.16-h6",
"PAN-OS 10.2.16-h4",
"PAN-OS 10.2.16-h1",
"PAN-OS 10.2.16",
"PAN-OS 10.2.15",
"PAN-OS 10.2.14-h1",
"PAN-OS 10.2.14",
"PAN-OS 10.2.13-h23",
"PAN-OS 10.2.13-h22",
"PAN-OS 10.2.13-h21",
"PAN-OS 10.2.13-h18",
"PAN-OS 10.2.13-h16",
"PAN-OS 10.2.13-h15",
"PAN-OS 10.2.13-h10",
"PAN-OS 10.2.13-h7",
"PAN-OS 10.2.13-h5",
"PAN-OS 10.2.13-h4",
"PAN-OS 10.2.13-h3",
"PAN-OS 10.2.13-h2",
"PAN-OS 10.2.13-h1",
"PAN-OS 10.2.13",
"PAN-OS 10.2.12-h6",
"PAN-OS 10.2.12-h5",
"PAN-OS 10.2.12-h4",
"PAN-OS 10.2.12-h3",
"PAN-OS 10.2.12-h2",
"PAN-OS 10.2.12-h1",
"PAN-OS 10.2.12",
"PAN-OS 10.2.11-h13",
"PAN-OS 10.2.11-h12",
"PAN-OS 10.2.11-h11",
"PAN-OS 10.2.11-h10",
"PAN-OS 10.2.11-h9",
"PAN-OS 10.2.11-h8",
"PAN-OS 10.2.11-h7",
"PAN-OS 10.2.11-h6",
"PAN-OS 10.2.11-h5",
"PAN-OS 10.2.11-h4",
"PAN-OS 10.2.11-h3",
"PAN-OS 10.2.11-h2",
"PAN-OS 10.2.11-h1",
"PAN-OS 10.2.11",
"PAN-OS 10.2.10-h39",
"PAN-OS 10.2.10-h37",
"PAN-OS 10.2.10-h36",
"PAN-OS 10.2.10-h31",
"PAN-OS 10.2.10-h30",
"PAN-OS 10.2.10-h27",
"PAN-OS 10.2.10-h26",
"PAN-OS 10.2.10-h23",
"PAN-OS 10.2.10-h21",
"PAN-OS 10.2.10-h18",
"PAN-OS 10.2.10-h17",
"PAN-OS 10.2.10-h14",
"PAN-OS 10.2.10-h13",
"PAN-OS 10.2.10-h12",
"PAN-OS 10.2.10-h11",
"PAN-OS 10.2.10-h10",
"PAN-OS 10.2.10-h9",
"PAN-OS 10.2.10-h8",
"PAN-OS 10.2.10-h7",
"PAN-OS 10.2.10-h6",
"PAN-OS 10.2.10-h5",
"PAN-OS 10.2.10-h4",
"PAN-OS 10.2.10-h3",
"PAN-OS 10.2.10-h2",
"PAN-OS 10.2.10-h1",
"PAN-OS 10.2.10",
"PAN-OS 10.2.9-h21",
"PAN-OS 10.2.9-h20",
"PAN-OS 10.2.9-h19",
"PAN-OS 10.2.9-h18",
"PAN-OS 10.2.9-h17",
"PAN-OS 10.2.9-h16",
"PAN-OS 10.2.9-h15",
"PAN-OS 10.2.9-h14",
"PAN-OS 10.2.9-h13",
"PAN-OS 10.2.9-h12",
"PAN-OS 10.2.9-h11",
"PAN-OS 10.2.9-h10",
"PAN-OS 10.2.9-h9",
"PAN-OS 10.2.9-h8",
"PAN-OS 10.2.9-h7",
"PAN-OS 10.2.9-h6",
"PAN-OS 10.2.9-h5",
"PAN-OS 10.2.9-h4",
"PAN-OS 10.2.9-h3",
"PAN-OS 10.2.9-h2",
"PAN-OS 10.2.9-h1",
"PAN-OS 10.2.9",
"PAN-OS 10.2.8-h21",
"PAN-OS 10.2.8-h20",
"PAN-OS 10.2.8-h19",
"PAN-OS 10.2.8-h18",
"PAN-OS 10.2.8-h17",
"PAN-OS 10.2.8-h16",
"PAN-OS 10.2.8-h15",
"PAN-OS 10.2.8-h14",
"PAN-OS 10.2.8-h13",
"PAN-OS 10.2.8-h12",
"PAN-OS 10.2.8-h11",
"PAN-OS 10.2.8-h10",
"PAN-OS 10.2.8-h9",
"PAN-OS 10.2.8-h8",
"PAN-OS 10.2.8-h7",
"PAN-OS 10.2.8-h6",
"PAN-OS 10.2.8-h5",
"PAN-OS 10.2.8-h4",
"PAN-OS 10.2.8-h3",
"PAN-OS 10.2.8-h2",
"PAN-OS 10.2.8-h1",
"PAN-OS 10.2.8",
"PAN-OS 10.2.7-h36",
"PAN-OS 10.2.7-h35",
"PAN-OS 10.2.7-h34",
"PAN-OS 10.2.7-h32",
"PAN-OS 10.2.7-h24",
"PAN-OS 10.2.7-h23",
"PAN-OS 10.2.7-h22",
"PAN-OS 10.2.7-h21",
"PAN-OS 10.2.7-h20",
"PAN-OS 10.2.7-h19",
"PAN-OS 10.2.7-h18",
"PAN-OS 10.2.7-h17",
"PAN-OS 10.2.7-h16",
"PAN-OS 10.2.7-h15",
"PAN-OS 10.2.7-h14",
"PAN-OS 10.2.7-h13",
"PAN-OS 10.2.7-h12",
"PAN-OS 10.2.7-h11",
"PAN-OS 10.2.7-h10",
"PAN-OS 10.2.7-h9",
"PAN-OS 10.2.7-h8",
"PAN-OS 10.2.7-h7",
"PAN-OS 10.2.7-h6",
"PAN-OS 10.2.7-h5",
"PAN-OS 10.2.7-h4",
"PAN-OS 10.2.7-h3",
"PAN-OS 10.2.7-h2",
"PAN-OS 10.2.7-h1",
"PAN-OS 10.2.7",
"PAN-OS 10.2.6-h6",
"PAN-OS 10.2.6-h5",
"PAN-OS 10.2.6-h4",
"PAN-OS 10.2.6-h3",
"PAN-OS 10.2.6-h2",
"PAN-OS 10.2.6-h1",
"PAN-OS 10.2.6",
"PAN-OS 10.2.5-h9",
"PAN-OS 10.2.5-h8",
"PAN-OS 10.2.5-h7",
"PAN-OS 10.2.5-h6",
"PAN-OS 10.2.5-h5",
"PAN-OS 10.2.5-h4",
"PAN-OS 10.2.5-h3",
"PAN-OS 10.2.5-h2",
"PAN-OS 10.2.5-h1",
"PAN-OS 10.2.5",
"PAN-OS 10.2.4-h32",
"PAN-OS 10.2.4-h31",
"PAN-OS 10.2.4-h30",
"PAN-OS 10.2.4-h29",
"PAN-OS 10.2.4-h28",
"PAN-OS 10.2.4-h27",
"PAN-OS 10.2.4-h26",
"PAN-OS 10.2.4-h25",
"PAN-OS 10.2.4-h24",
"PAN-OS 10.2.4-h23",
"PAN-OS 10.2.4-h22",
"PAN-OS 10.2.4-h21",
"PAN-OS 10.2.4-h20",
"PAN-OS 10.2.4-h19",
"PAN-OS 10.2.4-h18",
"PAN-OS 10.2.4-h17",
"PAN-OS 10.2.4-h16",
"PAN-OS 10.2.4-h15",
"PAN-OS 10.2.4-h14",
"PAN-OS 10.2.4-h13",
"PAN-OS 10.2.4-h12",
"PAN-OS 10.2.4-h11",
"PAN-OS 10.2.4-h10",
"PAN-OS 10.2.4-h9",
"PAN-OS 10.2.4-h8",
"PAN-OS 10.2.4-h7",
"PAN-OS 10.2.4-h6",
"PAN-OS 10.2.4-h5",
"PAN-OS 10.2.4-h4",
"PAN-OS 10.2.4-h3",
"PAN-OS 10.2.4-h2",
"PAN-OS 10.2.4-h1",
"PAN-OS 10.2.4",
"PAN-OS 10.2.3-h14",
"PAN-OS 10.2.3-h13",
"PAN-OS 10.2.3-h12",
"PAN-OS 10.2.3-h11",
"PAN-OS 10.2.3-h10",
"PAN-OS 10.2.3-h9",
"PAN-OS 10.2.3-h8",
"PAN-OS 10.2.3-h7",
"PAN-OS 10.2.3-h6",
"PAN-OS 10.2.3-h5",
"PAN-OS 10.2.3-h4",
"PAN-OS 10.2.3-h3",
"PAN-OS 10.2.3-h2",
"PAN-OS 10.2.3-h1",
"PAN-OS 10.2.3",
"PAN-OS 10.2.2-h6",
"PAN-OS 10.2.2-h5",
"PAN-OS 10.2.2-h4",
"PAN-OS 10.2.2-h3",
"PAN-OS 10.2.2-h2",
"PAN-OS 10.2.2-h1",
"PAN-OS 10.2.2",
"PAN-OS 10.2.1-h3",
"PAN-OS 10.2.1-h2",
"PAN-OS 10.2.1-h1",
"PAN-OS 10.2.1",
"PAN-OS 10.2.0-h4",
"PAN-OS 10.2.0-h3",
"PAN-OS 10.2.0-h2",
"PAN-OS 10.2.0-h1",
"PAN-OS 10.2.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0309",
"datePublished": "2026-09-10T05:44:10.148Z",
"dateReserved": "2025-11-03T20:45:08.103Z",
"dateUpdated": "2026-09-11T03:56:05.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0308 (GCVE-0-2026-0308)
Vulnerability from nvd – Published: 2026-09-10 05:48 – Updated: 2026-09-10 13:04
VLAI
EPSS
VEX
Title
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
Summary
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface.
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:03 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0308 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW |
Unaffected:
All
(custom)
|
|
| Palo Alto Networks | PAN-OS |
Unaffected:
12.2.0 , < 12.2.3
(custom)
Affected: 12.1.0 , < 12.1.10 (custom) Affected: 11.2.0 , < 11.2.13-h2 (custom) Affected: 11.1.0 , < 11.1.16-h2 (custom) cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access |
Unaffected:
All , < 12.1.4-h10
(custom)
|
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0308",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:03:47.811775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:04:03.221Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud NGFW",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "PAN-OS",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.2.3",
"status": "unaffected"
}
],
"lessThan": "12.2.3",
"status": "unaffected",
"version": "12.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "12.1.10",
"status": "unaffected"
}
],
"lessThan": "12.1.10",
"status": "affected",
"version": "12.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.2.13-h2",
"status": "unaffected"
}
],
"lessThan": "11.2.13-h2",
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.1.16-h2",
"status": "unaffected"
}
],
"lessThan": "11.1.16-h2",
"status": "affected",
"version": "11.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Prisma Access",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.1.7-h5",
"status": "unaffected"
}
],
"lessThan": "12.1.4-h10",
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eNo special configuration is required to be affected by this issue.\u003c/span\u003e"
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.13-h2",
"versionStartIncluding": "11.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.16-h2",
"versionStartIncluding": "11.1.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Micha\u0142 Skowron and Tomasz Stachowicz of ING Hubs Poland and James Otten (internal reporter)"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS\u00ae software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. \u003cbr\u003e\u003cbr\u003eThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). \u003cbr\u003e\u003cbr\u003eCloud NGFW and Prisma\u00ae Access are not affected by this vulnerability."
}
],
"value": "A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS\u00ae software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. \n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). \n\nCloud NGFW and Prisma\u00ae Access are not affected by this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 1.1,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "The risk is highest when you allow access to the management interface from external IP addresses on the internet."
}
]
},
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 0.4,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:48:46.726Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0308"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cspan\u003eCloud NGFW\u003c/span\u003e\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003cspan\u003eNo action needed.\u003c/span\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cspan\u003ePAN-OS 12.2\u003c/span\u003e\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003cspan\u003eNo action needed.\u003c/span\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 12.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.2 through 12.1.9\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.0 through 11.2.13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.13-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.0 through 11.1.16\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.16-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older\u003cbr\u003eunsupported\u003cbr\u003ePAN-OS versions\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "Version\nMinor Version\nSuggested Solution\nCloud NGFW\u00a0\u00a0No action needed.PAN-OS 12.2\u00a0\u00a0No action needed.\n PAN-OS 12.1\n\n 12.1.2 through 12.1.9\n Upgrade to 12.1.10 or later.\n \n PAN-OS 11.2\n\n 11.2.0 through 11.2.13\n Upgrade to 11.2.13-h2 or later.\n \n PAN-OS 11.1\n\n 11.1.0 through 11.1.16\n Upgrade to 11.1.16-h2 or later.\n All older\nunsupported\nPAN-OS versions\u00a0Upgrade to a supported fixed version.Prisma AccessNo action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eCustomers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510040 and 510041 (from Applications and Threats content version 9145-10233 and later). For these Threat IDs to protect against attacks for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id59206398-3dab-4b2f-9b4b-7ea500d036ba\"\u003eRoute incoming traffic for the MGT port through a DP port\u003c/a\u003e, e.g., enabling management profile on a DP interface for management access.\u003cbr\u003e\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id112f7714-8995-4496-bbf9-781e63dec71c\"\u003eReplace the Certificate for Inbound Traffic Management\u003c/a\u003e.\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#idbbd82587-17a2-42b4-9245-d3714e1e13a2\"\u003eDecrypt inbound traffic to the management interface so the firewall can inspect it\u003c/a\u003e.\u003c/li\u003e\u003cli\u003eEnable threat prevention on the inbound traffic to management services.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003ePlease note that this Threat ID requires SSL Decryption.\u003c/p\u003e"
}
],
"value": "No known workarounds exist for this issue.\n\n\n\nCustomers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510040 and 510041 (from Applications and Threats content version 9145-10233 and later). For these Threat IDs to protect against attacks for this vulnerability:\n\n * Route incoming traffic for the MGT port through a DP port https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id59206398-3dab-4b2f-9b4b-7ea500d036ba , e.g., enabling management profile on a DP interface for management access.\n\n * Replace the Certificate for Inbound Traffic Management https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id112f7714-8995-4496-bbf9-781e63dec71c .\n * Decrypt inbound traffic to the management interface so the firewall can inspect it https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#idbbd82587-17a2-42b4-9245-d3714e1e13a2 .\n * Enable threat prevention on the inbound traffic to management services.\n\n\n\n\nPlease note that this Threat ID requires SSL Decryption."
}
],
"x_affectedList": [
"PAN-OS 12.1.9",
"PAN-OS 12.1.8",
"PAN-OS 12.1.7-h3",
"PAN-OS 12.1.7-h2",
"PAN-OS 12.1.7-h1",
"PAN-OS 12.1.7",
"PAN-OS 12.1.6",
"PAN-OS 12.1.5",
"PAN-OS 12.1.4-h9",
"PAN-OS 12.1.4-h8",
"PAN-OS 12.1.4-h7",
"PAN-OS 12.1.4-h6",
"PAN-OS 12.1.4-h5",
"PAN-OS 12.1.4-h3",
"PAN-OS 12.1.4-h2",
"PAN-OS 12.1.4",
"PAN-OS 12.1.3-h3",
"PAN-OS 12.1.3-h1",
"PAN-OS 12.1.3",
"PAN-OS 12.1.2",
"PAN-OS 11.2.13-h1",
"PAN-OS 11.2.13",
"PAN-OS 11.2.12",
"PAN-OS 11.2.11",
"PAN-OS 11.2.10-h13",
"PAN-OS 11.2.10-h12",
"PAN-OS 11.2.10-h10",
"PAN-OS 11.2.10-h9",
"PAN-OS 11.2.10-h8",
"PAN-OS 11.2.10-h7",
"PAN-OS 11.2.10-h6",
"PAN-OS 11.2.10-h5",
"PAN-OS 11.2.10-h4",
"PAN-OS 11.2.10-h3",
"PAN-OS 11.2.10-h2",
"PAN-OS 11.2.10-h1",
"PAN-OS 11.2.10",
"PAN-OS 11.2.9",
"PAN-OS 11.2.8",
"PAN-OS 11.2.7-h19",
"PAN-OS 11.2.7-h18",
"PAN-OS 11.2.7-h17",
"PAN-OS 11.2.7-h16",
"PAN-OS 11.2.7-h15",
"PAN-OS 11.2.7-h14",
"PAN-OS 11.2.7-h13",
"PAN-OS 11.2.7-h12",
"PAN-OS 11.2.7-h11",
"PAN-OS 11.2.7-h10",
"PAN-OS 11.2.7-h8",
"PAN-OS 11.2.7-h7",
"PAN-OS 11.2.7-h4",
"PAN-OS 11.2.7-h3",
"PAN-OS 11.2.7-h2",
"PAN-OS 11.2.7-h1",
"PAN-OS 11.2.7",
"PAN-OS 11.2.6",
"PAN-OS 11.2.5",
"PAN-OS 11.2.4-h20",
"PAN-OS 11.2.4-h18",
"PAN-OS 11.2.4-h17",
"PAN-OS 11.2.4-h15",
"PAN-OS 11.2.4-h14",
"PAN-OS 11.2.4-h12",
"PAN-OS 11.2.4-h11",
"PAN-OS 11.2.4-h10",
"PAN-OS 11.2.4-h9",
"PAN-OS 11.2.4-h8",
"PAN-OS 11.2.4-h7",
"PAN-OS 11.2.4-h6",
"PAN-OS 11.2.4-h5",
"PAN-OS 11.2.4-h4",
"PAN-OS 11.2.4-h3",
"PAN-OS 11.2.4-h2",
"PAN-OS 11.2.4-h1",
"PAN-OS 11.2.4",
"PAN-OS 11.2.3-h5",
"PAN-OS 11.2.3-h4",
"PAN-OS 11.2.3-h3",
"PAN-OS 11.2.3-h2",
"PAN-OS 11.2.3-h1",
"PAN-OS 11.2.3",
"PAN-OS 11.2.2-h2",
"PAN-OS 11.2.2-h1",
"PAN-OS 11.2.1-h1",
"PAN-OS 11.2.1",
"PAN-OS 11.2.0-h1",
"PAN-OS 11.2.0",
"PAN-OS 11.1.16-h1",
"PAN-OS 11.1.16",
"PAN-OS 11.1.15",
"PAN-OS 11.1.14",
"PAN-OS 11.1.13-h11",
"PAN-OS 11.1.13-h10",
"PAN-OS 11.1.13-h9",
"PAN-OS 11.1.13-h8",
"PAN-OS 11.1.13-h7",
"PAN-OS 11.1.13-h6",
"PAN-OS 11.1.13-h5",
"PAN-OS 11.1.13-h3",
"PAN-OS 11.1.13-h2",
"PAN-OS 11.1.13-h1",
"PAN-OS 11.1.13",
"PAN-OS 11.1.12",
"PAN-OS 11.1.11",
"PAN-OS 11.1.10-h32",
"PAN-OS 11.1.10-h30",
"PAN-OS 11.1.10-h28",
"PAN-OS 11.1.10-h27",
"PAN-OS 11.1.10-h26",
"PAN-OS 11.1.10-h25",
"PAN-OS 11.1.10-h21",
"PAN-OS 11.1.10-h12",
"PAN-OS 11.1.10-h10",
"PAN-OS 11.1.10-h9",
"PAN-OS 11.1.10-h7",
"PAN-OS 11.1.10-h5",
"PAN-OS 11.1.10-h4",
"PAN-OS 11.1.10-h1",
"PAN-OS 11.1.10",
"PAN-OS 11.1.9",
"PAN-OS 11.1.8",
"PAN-OS 11.1.6-h36",
"PAN-OS 11.1.6-h35",
"PAN-OS 11.1.6-h34",
"PAN-OS 11.1.6-h33",
"PAN-OS 11.1.6-h32",
"PAN-OS 11.1.6-h29",
"PAN-OS 11.1.6-h25",
"PAN-OS 11.1.6-h23",
"PAN-OS 11.1.6-h22",
"PAN-OS 11.1.6-h21",
"PAN-OS 11.1.6-h20",
"PAN-OS 11.1.6-h19",
"PAN-OS 11.1.6-h18",
"PAN-OS 11.1.6-h17",
"PAN-OS 11.1.6-h14",
"PAN-OS 11.1.6-h10",
"PAN-OS 11.1.6-h7",
"PAN-OS 11.1.6-h6",
"PAN-OS 11.1.6-h4",
"PAN-OS 11.1.6-h3",
"PAN-OS 11.1.6-h2",
"PAN-OS 11.1.6-h1",
"PAN-OS 11.1.6",
"PAN-OS 11.1.5-h1",
"PAN-OS 11.1.5",
"PAN-OS 11.1.4-h35",
"PAN-OS 11.1.4-h34",
"PAN-OS 11.1.4-h33",
"PAN-OS 11.1.4-h32",
"PAN-OS 11.1.4-h27",
"PAN-OS 11.1.4-h25",
"PAN-OS 11.1.4-h18",
"PAN-OS 11.1.4-h17",
"PAN-OS 11.1.4-h15",
"PAN-OS 11.1.4-h13",
"PAN-OS 11.1.4-h12",
"PAN-OS 11.1.4-h11",
"PAN-OS 11.1.4-h10",
"PAN-OS 11.1.4-h9",
"PAN-OS 11.1.4-h8",
"PAN-OS 11.1.4-h7",
"PAN-OS 11.1.4-h6",
"PAN-OS 11.1.4-h5",
"PAN-OS 11.1.4-h4",
"PAN-OS 11.1.4-h3",
"PAN-OS 11.1.4-h2",
"PAN-OS 11.1.4-h1",
"PAN-OS 11.1.4",
"PAN-OS 11.1.3-h13",
"PAN-OS 11.1.3-h12",
"PAN-OS 11.1.3-h11",
"PAN-OS 11.1.3-h10",
"PAN-OS 11.1.3-h9",
"PAN-OS 11.1.3-h8",
"PAN-OS 11.1.3-h7",
"PAN-OS 11.1.3-h6",
"PAN-OS 11.1.3-h5",
"PAN-OS 11.1.3-h4",
"PAN-OS 11.1.3-h3",
"PAN-OS 11.1.3-h2",
"PAN-OS 11.1.3-h1",
"PAN-OS 11.1.3",
"PAN-OS 11.1.2-h18",
"PAN-OS 11.1.2-h17",
"PAN-OS 11.1.2-h16",
"PAN-OS 11.1.2-h15",
"PAN-OS 11.1.2-h14",
"PAN-OS 11.1.2-h13",
"PAN-OS 11.1.2-h12",
"PAN-OS 11.1.2-h11",
"PAN-OS 11.1.2-h10",
"PAN-OS 11.1.2-h9",
"PAN-OS 11.1.2-h8",
"PAN-OS 11.1.2-h7",
"PAN-OS 11.1.2-h6",
"PAN-OS 11.1.2-h5",
"PAN-OS 11.1.2-h4",
"PAN-OS 11.1.2-h3",
"PAN-OS 11.1.2-h2",
"PAN-OS 11.1.2-h1",
"PAN-OS 11.1.2",
"PAN-OS 11.1.1-h2",
"PAN-OS 11.1.1-h1",
"PAN-OS 11.1.1",
"PAN-OS 11.1.0-h4",
"PAN-OS 11.1.0-h3",
"PAN-OS 11.1.0-h2",
"PAN-OS 11.1.0-h1",
"PAN-OS 11.1.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0308",
"datePublished": "2026-09-10T05:48:46.726Z",
"dateReserved": "2025-11-03T20:45:07.021Z",
"dateUpdated": "2026-09-10T13:04:03.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0307 (GCVE-0-2026-0307)
Vulnerability from nvd – Published: 2026-09-10 05:51 – Updated: 2026-09-11 03:56
VLAI
EPSS
VEX
Title
GlobalProtect App: Local Privilege Escalation Vulnerabilities
Summary
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
This GlobalProtect app on iOS, Android and ChromeOS is not impacted.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 00:00 UTC
CWE
- CWE-426 - Untrusted Search Path
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0307 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h15
(custom)
Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h15
(custom)
Affected: 6.2.0 , < 6.2.8-h14 (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Affected:
All
(custom)
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:ChromeOS:*:* |
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0307",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:56:04.416Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"macOS",
"Windows"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.8-h14",
"status": "unaffected"
}
],
"lessThan": "6.2.8-h14",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:ChromeOS:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"iOS",
"Android",
"ChromeOS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Linux:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "6.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Linux:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "6.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Windows:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "6.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:*",
"versionEndExcluding": "6.2.8-h14",
"versionStartIncluding": "6.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Windows:*:*",
"versionEndExcluding": "6.2.8-h14",
"versionStartIncluding": "6.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Windows:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:iOS:*:*",
"versionStartIncluding": "all",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Android:*:*",
"versionStartIncluding": "all",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:ChromeOS:*:*",
"versionStartIncluding": "all",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "our internal security research teams"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eMultiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect\u2122 app allows a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThis GlobalProtect app on iOS, Android and ChromeOS is not impacted.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect\u2122 app allows a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\n\n\nThis GlobalProtect app on iOS, Android and ChromeOS is not impacted."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426 Untrusted Search Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:51:53.090Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0307"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2/6.3 on Linux\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.3.3-h14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.0 on Linux\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.3 on macOS\u003c/td\u003e\u003ctd\u003e6.3.0 through 6.3.3-h14\u003c/td\u003e\u003ctd\u003eUpgrade to 6.3.3-h15 or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.2.8-h13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.2.8-h14 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.0 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.3 on Windows\u003c/td\u003e\u003ctd\u003e6.3.0 through 6.3.3-h14\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to 6.3.3-h15 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.2 on Windows\u0026nbsp;\u003c/td\u003e\u003ctd\u003e6.2.0 through 6.2.8-h13\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to 6.2.8-h14 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.0 on Windows\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on iOS\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Android\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on ChromeOS\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 12.2\u003c/td\u003e\u003ctd\u003e12.2.0 through 12.2.2\u2003\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to 12.2.3 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 12.1\u003c/td\u003e\u003ctd\u003e12.1.8 through 12.1.9\u003c/td\u003e\u003ctd\u003eUpgrade to 12.1.10 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e12.1.5 through 12.1.7-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 12.1.7-h5 or 12.1.10 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e12.1.2 through 12.1.4-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 12.1.4-h10 or 12.1.10 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 11.2\u003c/td\u003e\u003ctd\u003e11.2.11 through 11.2.13-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.2.13-h2 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.2.8 through 11.2.10-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.2.10-h14 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.2.5 through 11.2.7-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.2.7-h20 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.2.0 through 11.2.4-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.2.4-h21 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 11.1\u003c/td\u003e\u003ctd\u003e11.1.14 through 11.1.16-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.16 or 11.1.16-h2 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.1.11 through 11.1.13-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.13-h12 or 11.1.16 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.1.8 through 11.1.10-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.10-h33 or 11.1.16 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.1.7 through 11.1.7-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.7-h10 or 11.1.16 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.1.5 through 11.1.6-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.6-h38 or 11.1.16 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.1.0 through 11.1.4-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.4-h36 or 11.1.16 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 10.2\u003c/td\u003e\u003ctd\u003e10.2.17 through 10.2.18-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.18-h10 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e10.2.14 through 10.2.16-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.16-h10 or 10.2.18 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e10.2.11 through 10.2.13-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.13-h24 or 10.2.18 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e10.2.8 through 10.2.10-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.10-h40 or 10.2.18 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e10.2.0 through 10.2.7-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.7-h37 or 10.2.18 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older\u0026nbsp;unsupported\u0026nbsp;PAN-OS versions\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access 12.1\u003c/td\u003e\u003ctd\u003e12.1.2 through 12.1.*\u003c/td\u003e\u003ctd\u003eUpgrade to 12.1.7-h5 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access 11.2\u003c/td\u003e\u003ctd\u003e11.2.0 through 11.2*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.2.7-h20 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access 10.2\u003c/td\u003e\u003ctd\u003e10.2.0 through 10.2.*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.10-h40 or later.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "Version\nMinor Version\nSuggested Solution\n\n GlobalProtect App 6.2/6.3 on Linux\n\n 6.2.0 through 6.3.3-h14\n Upgrade to 6.3.3-h15 or later.\n \n GlobalProtect App 6.0 on Linux\n\n 6.0.0 through 6.0.14\n Upgrade to 6.0.15 or later.\n GlobalProtect App 6.3 on macOS6.3.0 through 6.3.3-h14Upgrade to 6.3.3-h15 or later.\n\n GlobalProtect App 6.2 on macOS\n\n 6.2.0 through 6.2.8-h13\n Upgrade to 6.2.8-h14 or later.\n \n GlobalProtect App 6.0 on macOS\n\n 6.0.0 through 6.0.14\n Upgrade to 6.0.15 or later.\n GlobalProtect App 6.3 on Windows6.3.0 through 6.3.3-h14\u00a0Upgrade to 6.3.3-h15 or later.\u00a0GlobalProtect App 6.2 on Windows\u00a06.2.0 through 6.2.8-h13\u00a0Upgrade to 6.2.8-h14 or later.\u00a0GlobalProtect App 6.0 on Windows6.0.0 through 6.0.14\u00a0Upgrade to 6.0.15 or later.\u00a0GlobalProtect App on iOS\u00a0\u00a0No action needed.GlobalProtect App on Android\u00a0\u00a0No action needed.\u00a0GlobalProtect App on ChromeOS\u00a0\u00a0No action needed.\u00a0PAN-OS 12.212.2.0 through 12.2.2\u2003\u00a0Upgrade to 12.2.3 or later.\u00a0PAN-OS 12.112.1.8 through 12.1.9Upgrade to 12.1.10 or later.\u00a012.1.5 through 12.1.7-h*Upgrade to 12.1.7-h5 or 12.1.10 or later.\u00a012.1.2 through 12.1.4-h*Upgrade to 12.1.4-h10 or 12.1.10 or later.PAN-OS 11.211.2.11 through 11.2.13-h*Upgrade to 11.2.13-h2 or later.\u00a011.2.8 through 11.2.10-h*Upgrade to 11.2.10-h14 or later.\u00a011.2.5 through 11.2.7-h*Upgrade to 11.2.7-h20 or later.\u00a011.2.0 through 11.2.4-h*Upgrade to 11.2.4-h21 or later.PAN-OS 11.111.1.14 through 11.1.16-h*Upgrade to 11.1.16 or 11.1.16-h2 or later.\u00a011.1.11 through 11.1.13-h*Upgrade to 11.1.13-h12 or 11.1.16 or later.\u00a011.1.8 through 11.1.10-h*Upgrade to 11.1.10-h33 or 11.1.16 or later.\u00a011.1.7 through 11.1.7-h*Upgrade to 11.1.7-h10 or 11.1.16 or later.\u00a011.1.5 through 11.1.6-h*Upgrade to 11.1.6-h38 or 11.1.16 or later.\u00a011.1.0 through 11.1.4-h*Upgrade to 11.1.4-h36 or 11.1.16 or later.PAN-OS 10.210.2.17 through 10.2.18-h*Upgrade to 10.2.18-h10 or later.\u00a010.2.14 through 10.2.16-h*Upgrade to 10.2.16-h10 or 10.2.18 or later.\u00a010.2.11 through 10.2.13-h*Upgrade to 10.2.13-h24 or 10.2.18 or later.\u00a0\u00a010.2.8 through 10.2.10-h*Upgrade to 10.2.10-h40 or 10.2.18 or later.\u00a010.2.0 through 10.2.7-h*Upgrade to 10.2.7-h37 or 10.2.18 or later.All older\u00a0unsupported\u00a0PAN-OS versions\u00a0Upgrade to a supported fixed version.Prisma Access 12.112.1.2 through 12.1.*Upgrade to 12.1.7-h5 or later.Prisma Access 11.211.2.0 through 11.2*Upgrade to 11.2.7-h20 or later.Prisma Access 10.210.2.0 through 10.2.*Upgrade to 10.2.10-h40 or later."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication."
}
],
"title": "GlobalProtect App: Local Privilege Escalation Vulnerabilities",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"GlobalProtect App 6.3.3",
"GlobalProtect App 6.3.2",
"GlobalProtect App 6.3.1",
"GlobalProtect App 6.3.0",
"GlobalProtect App 6.3",
"GlobalProtect App 6.0.14",
"GlobalProtect App 6.0.13",
"GlobalProtect App 6.0.12",
"GlobalProtect App 6.0.11",
"GlobalProtect App 6.0.10",
"GlobalProtect App 6.0.8",
"GlobalProtect App 6.0.7",
"GlobalProtect App 6.0.6",
"GlobalProtect App 6.0.5",
"GlobalProtect App 6.0.4",
"GlobalProtect App 6.0.3",
"GlobalProtect App 6.0.2",
"GlobalProtect App 6.0.1",
"GlobalProtect App 6.0.0",
"GlobalProtect App 6.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0307",
"datePublished": "2026-09-10T05:51:53.090Z",
"dateReserved": "2025-11-03T20:45:06.164Z",
"dateUpdated": "2026-09-11T03:56:04.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0306 (GCVE-0-2026-0306)
Vulnerability from nvd – Published: 2026-09-10 05:55 – Updated: 2026-09-10 13:03
VLAI
EPSS
VEX
Title
Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows
Summary
A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data.
This Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:02 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0306 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Prisma Access Agent |
Affected:
0 , < 26.2
(custom)
cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:windows:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access Agent |
Unaffected:
All , < 6.3.3-h15
(custom)
|
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:02:56.381680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:03:06.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "26.2",
"status": "unaffected"
}
],
"lessThan": "26.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"macOS",
"iOS",
"Android",
"ChromeOS"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "26.2",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:ios:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:android:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:chromeos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vladislav Ovitchinikov and Daniel Cuthbert"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eA vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma\u00ae Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data. \u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThis Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not affected.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma\u00ae Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data. \n\n\n\nThis Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:55:23.322Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0306"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003c/th\u003e\u003cth\u003eMinor Version\u003c/th\u003e\u003cth\u003eSuggested Solution\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Windows\u003c/td\u003e\u003ctd\u003e\u003cspan\u003e24.0 through 26.2\u003c/span\u003e\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 26.2 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Linux\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u003cspan\u003eNo action needed.\u003c/span\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on macOS\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on iOS\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Android\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on ChromeOS\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VersionMinor VersionSuggested SolutionPrisma Access Agent on Windows24.0 through 26.2\nUpgrade to 26.2 or later.Prisma Access Agent on Linux\u00a0No action needed.Prisma Access Agent on macOS\u00a0\u00a0No action needed.Prisma Access Agent on iOS\u00a0\u00a0No action needed.\u00a0Prisma Access Agent on Android\u00a0\u00a0No action needed.\u00a0Prisma Access Agent on ChromeOS\u00a0\u00a0No action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0306",
"datePublished": "2026-09-10T05:55:23.322Z",
"dateReserved": "2025-11-03T20:45:04.920Z",
"dateUpdated": "2026-09-10T13:03:06.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0305 (GCVE-0-2026-0305)
Vulnerability from nvd – Published: 2026-09-10 05:57 – Updated: 2026-09-10 13:02
VLAI
EPSS
VEX
Title
Prisma Access Agent: Information Disclosure Vulnerability on Linux
Summary
An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credentials.
The Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:02 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0305 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Prisma Access Agent |
Affected:
24.0 , < 26.2
(custom)
cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:linux:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access Agent |
Unaffected:
All , < 6.3.3-h15
(custom)
|
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0305",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:02:33.310473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:02:43.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "26.3",
"status": "unaffected"
}
],
"lessThan": "26.2",
"status": "affected",
"version": "24.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"macOS",
"Windows",
"iOS",
"Android",
"ChromeOS"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eNo special configuration is required to be affected by this issue.\u003c/span\u003e"
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "26.2",
"versionStartIncluding": "24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:ios:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:android:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:chromeos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue."
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eAn information disclosure vulnerability in the Palo Alto Networks Prisma\u00ae Access Agent on Linux enables a local user to access sensitive configuration data and credentials.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThe Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected.\u003c/span\u003e\u003c/p\u003e\u003cb\u003e\u003cp\u003e\u003c/p\u003e\u003c/b\u003e"
}
],
"value": "An information disclosure vulnerability in the Palo Alto Networks Prisma\u00ae Access Agent on Linux enables a local user to access sensitive configuration data and credentials.\n\n\n\nThe Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-118",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-118 Collect and Analyze Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:57:01.119Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0305"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003c/th\u003e\u003cth\u003eMinor Version\u003c/th\u003e\u003cth\u003eSuggested Solution\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Linux\u003c/td\u003e\u003ctd\u003e\u003cspan\u003e25.7 through 26.2.2\u003c/span\u003e\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003cspan\u003eUpgrade to 26.3 or later.\u003c/span\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on macOS\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Windows\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on iOS\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Android\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on ChromeOS\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VersionMinor VersionSuggested SolutionPrisma Access Agent on Linux25.7 through 26.2.2\nUpgrade to 26.3 or later.Prisma Access Agent on macOS\u00a0No action needed.Prisma Access Agent on Windows\u00a0No action needed.Prisma Access Agent on iOS\u00a0No action needed.Prisma Access Agent on Android\u00a0No action needed.Prisma Access Agent on ChromeOS\u00a0No action needed."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Prisma Access Agent: Information Disclosure Vulnerability on Linux",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eNo known workarounds or mitigations exist for this issue.\u003c/span\u003e"
}
],
"value": "No known workarounds or mitigations exist for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0305",
"datePublished": "2026-09-10T05:57:01.119Z",
"dateReserved": "2025-11-03T20:45:03.983Z",
"dateUpdated": "2026-09-10T13:02:43.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0301 (GCVE-0-2026-0301)
Vulnerability from nvd – Published: 2026-08-13 02:05 – Updated: 2026-08-14 18:27
VLAI
EPSS
VEX
Title
PAN-OS: Information Disclosure Vulnerability in URL Filtering
Summary
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information.
Panorama is not impacted by this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:31 UTC
CWE
- CWE-908 - Use of Uninitialized Resource
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0301 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW |
Affected:
All
(custom)
cpe:2.3:a:palo_alto_networks:cloud_ngfw:all:*:aws:*:*:*:*:* cpe:2.3:a:palo_alto_networks:cloud_ngfw:all:*:azure:*:*:*:*:* |
|
| Palo Alto Networks | PAN-OS |
Unaffected:
12.1.0
(custom)
Unaffected: 11.2.0 (custom) Affected: 11.1.0 , < 11.1.16-h1 (custom) Affected: 10.2.0 , < 10.2.8 (custom) cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access |
Unaffected:
12.1.0
(custom)
Unaffected: 11.2.0 (custom) Affected: 10.2.0 , < 10.2.10 (custom) cpe:2.3:a:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:* |
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0301",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:31:13.098717Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:33:36.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"platforms": [
"AWS",
"Azure"
],
"product": "Cloud NGFW",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "PAN-OS",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "12.1.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.1.16-h1",
"status": "unaffected"
}
],
"lessThan": "11.1.16-h1",
"status": "affected",
"version": "11.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "10.2.8",
"status": "unaffected"
}
],
"lessThan": "10.2.8",
"status": "affected",
"version": "10.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Prisma Access",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "12.1.0",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "10.2.10",
"status": "unaffected"
}
],
"lessThan": "10.2.10",
"status": "affected",
"version": "10.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis issue applies only to firewalls where URL filtering is enabled with customized response page. \u003cb\u003e\u003cbr\u003e\u003cbr\u003e\u003c/b\u003eTo check if a PAN-OS device has Customized URL Filtering response pages, navigate to: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/administration/firewall-administration/launch-the-web-interface/configure-response-pages\"\u003eDevice \u0026gt; Response Pages\u003c/a\u003e\u003cb\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/administration/firewall-administration/launch-the-web-interface/configure-response-pages\"\u003e\u003cbr\u003e\u003c/a\u003e\u003c/b\u003eIf you have imported a custom URL Filtering HTML response page, your device is affected.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "This issue applies only to firewalls where URL filtering is enabled with customized response page. \n\nTo check if a PAN-OS device has Customized URL Filtering response pages, navigate to: Device \u003e Response Pages https://docs.paloaltonetworks.com/ngfw/administration/firewall-administration/launch-the-web-interface/configure-response-pages \n https://docs.paloaltonetworks.com/ngfw/administration/firewall-administration/launch-the-web-interface/configure-response-pages If you have imported a custom URL Filtering HTML response page, your device is affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:cloud_ngfw:all:*:aws:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:cloud_ngfw:all:*:azure:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:pan-os:12.1.0:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.16-h1",
"versionStartIncluding": "11.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.8",
"versionStartIncluding": "10.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access:12.1.0:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access:11.2.0:*:*:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.10",
"versionStartIncluding": "10.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jan Breig"
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eAn information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS\u00ae software enables an unauthenticated user with network access to obtain sensitive information.\u003c/span\u003e\u003cb\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/b\u003e\u003cspan\u003ePanorama is not impacted by this vulnerability.\u003c/span\u003e"
}
],
"value": "An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS\u00ae software enables an unauthenticated user with network access to obtain sensitive information.\n\nPanorama is not impacted by this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 1.7,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 0.5,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "The risk of exploitation is lower for Prisma Access as it requires an authenticated user and the external network access to the management interface is restricted."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "CWE-908 Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T18:27:26.549Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0301"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eCloud NGFW*\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eCustomers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 12.1\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e12.1.2 through 12.1.6-h*\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 11.2\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e11.2.0 through 11.2.12\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.0 through 11.1.16-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.16-h1 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 10.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.0 through 10.2.*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.8 or 11.1.16-h1 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older\u003cbr\u003eunsupported\u003cbr\u003ePAN-OS versions\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access 12.1\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e12.1.2 through 12.1.*\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access 11.2\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e11.2.0 through 11.2*\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Access 10.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.0 through 10.2.*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cspan\u003e* See the note under Product Status for information regarding Prisma Access and Cloud NGFW upgrades.\u003c/span\u003e"
}
],
"value": "Version\nMinor Version\nSuggested Solution\nCloud NGFW*Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade.PAN-OS 12.1\n12.1.2 through 12.1.6-h*No action needed.PAN-OS 11.2\n11.2.0 through 11.2.12\nNo action needed.\n PAN-OS 11.1\n\n 11.1.0 through 11.1.16-h*\n Upgrade to 11.1.16-h1 or later.\n \n PAN-OS 10.2\n\n 10.2.0 through 10.2.*\n Upgrade to 10.2.8 or 11.1.16-h1 or later.\n All older\nunsupported\nPAN-OS versions\u00a0Upgrade to a supported fixed version.Prisma Access 12.1\n12.1.2 through 12.1.*\nNo action needed.Prisma Access 11.2\n11.2.0 through 11.2*\nNo action needed.\n Prisma Access 10.2\n\n 10.2.0 through 10.2.*\n Upgrade to 10.2.10 or later.\n * See the note under Product Status for information regarding Prisma Access and Cloud NGFW upgrades."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial publication"
}
],
"title": "PAN-OS: Information Disclosure Vulnerability in URL Filtering",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eCustomers can mitigate this issue by limiting the\u003c/span\u003e \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/url-filtering-response-pages/url-filtering-response-page-objects#idf281835b-ab7c-4553-93e2-46967443f9f9_id8313c239-3cf5-4bee-8909-e8e047b70b44\"\u003e\u003cspan\u003eResponse Page Variables\u003c/span\u003e\u003c/a\u003e\u003cspan\u003e on their response page to only those in the\u003c/span\u003e \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/url-filtering-response-pages/predefined-url-filtering-response-pages#ida9f33d58-e2ea-4a6f-9b4f-0ab42fd6921f\"\u003e\u003cspan\u003ePredefined URL Filtering Response Pages\u003c/span\u003e\u003c/a\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/url-filtering-response-pages/predefined-url-filtering-response-pages#ida9f33d58-e2ea-4a6f-9b4f-0ab42fd6921f\"\u003e\u003cspan\u003e.\u003c/span\u003e\u003c/a\u003e\u003cspan\u003e The variables that are included in our predefined response pages (user, url, category, pan_form) are not impacted by this vulnerability.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Customers can mitigate this issue by limiting the Response Page Variables https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/url-filtering-response-pages/url-filtering-response-page-objects#idf281835b-ab7c-4553-93e2-46967443f9f9_id8313c239-3cf5-4bee-8909-e8e047b70b44 on their response page to only those in the Predefined URL Filtering Response Pages https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/url-filtering-response-pages/predefined-url-filtering-response-pages#ida9f33d58-e2ea-4a6f-9b4f-0ab42fd6921f . https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/url-filtering-response-pages/predefined-url-filtering-response-pages#ida9f33d58-e2ea-4a6f-9b4f-0ab42fd6921f The variables that are included in our predefined response pages (user, url, category, pan_form) are not impacted by this vulnerability."
}
],
"x_affectedList": [
"PAN-OS 11.1.16",
"PAN-OS 11.1.15",
"PAN-OS 11.1.14",
"PAN-OS 11.1.13-h10",
"PAN-OS 11.1.13-h9",
"PAN-OS 11.1.13-h8",
"PAN-OS 11.1.13-h7",
"PAN-OS 11.1.13-h6",
"PAN-OS 11.1.13-h5",
"PAN-OS 11.1.13-h3",
"PAN-OS 11.1.13-h2",
"PAN-OS 11.1.13-h1",
"PAN-OS 11.1.13",
"PAN-OS 11.1.12",
"PAN-OS 11.1.11",
"PAN-OS 11.1.10-h30",
"PAN-OS 11.1.10-h28",
"PAN-OS 11.1.10-h27",
"PAN-OS 11.1.10-h26",
"PAN-OS 11.1.10-h25",
"PAN-OS 11.1.10-h21",
"PAN-OS 11.1.10-h12",
"PAN-OS 11.1.10-h10",
"PAN-OS 11.1.10-h9",
"PAN-OS 11.1.10-h7",
"PAN-OS 11.1.10-h5",
"PAN-OS 11.1.10-h4",
"PAN-OS 11.1.10-h1",
"PAN-OS 11.1.10",
"PAN-OS 11.1.9",
"PAN-OS 11.1.8",
"PAN-OS 11.1.6-h36",
"PAN-OS 11.1.6-h35",
"PAN-OS 11.1.6-h34",
"PAN-OS 11.1.6-h33",
"PAN-OS 11.1.6-h32",
"PAN-OS 11.1.6-h29",
"PAN-OS 11.1.6-h25",
"PAN-OS 11.1.6-h23",
"PAN-OS 11.1.6-h22",
"PAN-OS 11.1.6-h21",
"PAN-OS 11.1.6-h20",
"PAN-OS 11.1.6-h19",
"PAN-OS 11.1.6-h18",
"PAN-OS 11.1.6-h17",
"PAN-OS 11.1.6-h14",
"PAN-OS 11.1.6-h10",
"PAN-OS 11.1.6-h7",
"PAN-OS 11.1.6-h6",
"PAN-OS 11.1.6-h4",
"PAN-OS 11.1.6-h3",
"PAN-OS 11.1.6-h2",
"PAN-OS 11.1.6-h1",
"PAN-OS 11.1.6",
"PAN-OS 11.1.5-h1",
"PAN-OS 11.1.5",
"PAN-OS 11.1.4-h35",
"PAN-OS 11.1.4-h34",
"PAN-OS 11.1.4-h33",
"PAN-OS 11.1.4-h32",
"PAN-OS 11.1.4-h27",
"PAN-OS 11.1.4-h25",
"PAN-OS 11.1.4-h18",
"PAN-OS 11.1.4-h17",
"PAN-OS 11.1.4-h15",
"PAN-OS 11.1.4-h13",
"PAN-OS 11.1.4-h12",
"PAN-OS 11.1.4-h11",
"PAN-OS 11.1.4-h10",
"PAN-OS 11.1.4-h9",
"PAN-OS 11.1.4-h8",
"PAN-OS 11.1.4-h7",
"PAN-OS 11.1.4-h6",
"PAN-OS 11.1.4-h5",
"PAN-OS 11.1.4-h4",
"PAN-OS 11.1.4-h3",
"PAN-OS 11.1.4-h2",
"PAN-OS 11.1.4-h1",
"PAN-OS 11.1.4",
"PAN-OS 11.1.3-h13",
"PAN-OS 11.1.3-h12",
"PAN-OS 11.1.3-h11",
"PAN-OS 11.1.3-h10",
"PAN-OS 11.1.3-h9",
"PAN-OS 11.1.3-h8",
"PAN-OS 11.1.3-h7",
"PAN-OS 11.1.3-h6",
"PAN-OS 11.1.3-h5",
"PAN-OS 11.1.3-h4",
"PAN-OS 11.1.3-h3",
"PAN-OS 11.1.3-h2",
"PAN-OS 11.1.3-h1",
"PAN-OS 11.1.3",
"PAN-OS 11.1.2-h18",
"PAN-OS 11.1.2-h17",
"PAN-OS 11.1.2-h16",
"PAN-OS 11.1.2-h15",
"PAN-OS 11.1.2-h14",
"PAN-OS 11.1.2-h13",
"PAN-OS 11.1.2-h12",
"PAN-OS 11.1.2-h11",
"PAN-OS 11.1.2-h10",
"PAN-OS 11.1.2-h9",
"PAN-OS 11.1.2-h8",
"PAN-OS 11.1.2-h7",
"PAN-OS 11.1.2-h6",
"PAN-OS 11.1.2-h5",
"PAN-OS 11.1.2-h4",
"PAN-OS 11.1.2-h3",
"PAN-OS 11.1.2-h2",
"PAN-OS 11.1.2-h1",
"PAN-OS 11.1.2",
"PAN-OS 11.1.1-h2",
"PAN-OS 11.1.1-h1",
"PAN-OS 11.1.1",
"PAN-OS 11.1.0-h4",
"PAN-OS 11.1.0-h3",
"PAN-OS 11.1.0-h2",
"PAN-OS 11.1.0-h1",
"PAN-OS 11.1.0",
"PAN-OS 10.2.7-h36",
"PAN-OS 10.2.7-h35",
"PAN-OS 10.2.7-h34",
"PAN-OS 10.2.7-h32",
"PAN-OS 10.2.7-h24",
"PAN-OS 10.2.7-h23",
"PAN-OS 10.2.7-h22",
"PAN-OS 10.2.7-h21",
"PAN-OS 10.2.7-h20",
"PAN-OS 10.2.7-h19",
"PAN-OS 10.2.7-h18",
"PAN-OS 10.2.7-h17",
"PAN-OS 10.2.7-h16",
"PAN-OS 10.2.7-h15",
"PAN-OS 10.2.7-h14",
"PAN-OS 10.2.7-h13",
"PAN-OS 10.2.7-h12",
"PAN-OS 10.2.7-h11",
"PAN-OS 10.2.7-h10",
"PAN-OS 10.2.7-h9",
"PAN-OS 10.2.7-h8",
"PAN-OS 10.2.7-h7",
"PAN-OS 10.2.7-h6",
"PAN-OS 10.2.7-h5",
"PAN-OS 10.2.7-h4",
"PAN-OS 10.2.7-h3",
"PAN-OS 10.2.7-h2",
"PAN-OS 10.2.7-h1",
"PAN-OS 10.2.7",
"PAN-OS 10.2.6-h6",
"PAN-OS 10.2.6-h5",
"PAN-OS 10.2.6-h4",
"PAN-OS 10.2.6-h3",
"PAN-OS 10.2.6-h2",
"PAN-OS 10.2.6-h1",
"PAN-OS 10.2.6",
"PAN-OS 10.2.5-h9",
"PAN-OS 10.2.5-h8",
"PAN-OS 10.2.5-h7",
"PAN-OS 10.2.5-h6",
"PAN-OS 10.2.5-h5",
"PAN-OS 10.2.5-h4",
"PAN-OS 10.2.5-h3",
"PAN-OS 10.2.5-h2",
"PAN-OS 10.2.5-h1",
"PAN-OS 10.2.5",
"PAN-OS 10.2.4-h32",
"PAN-OS 10.2.4-h31",
"PAN-OS 10.2.4-h30",
"PAN-OS 10.2.4-h29",
"PAN-OS 10.2.4-h28",
"PAN-OS 10.2.4-h27",
"PAN-OS 10.2.4-h26",
"PAN-OS 10.2.4-h25",
"PAN-OS 10.2.4-h24",
"PAN-OS 10.2.4-h23",
"PAN-OS 10.2.4-h22",
"PAN-OS 10.2.4-h21",
"PAN-OS 10.2.4-h20",
"PAN-OS 10.2.4-h19",
"PAN-OS 10.2.4-h18",
"PAN-OS 10.2.4-h17",
"PAN-OS 10.2.4-h16",
"PAN-OS 10.2.4-h15",
"PAN-OS 10.2.4-h14",
"PAN-OS 10.2.4-h13",
"PAN-OS 10.2.4-h12",
"PAN-OS 10.2.4-h11",
"PAN-OS 10.2.4-h10",
"PAN-OS 10.2.4-h9",
"PAN-OS 10.2.4-h8",
"PAN-OS 10.2.4-h7",
"PAN-OS 10.2.4-h6",
"PAN-OS 10.2.4-h5",
"PAN-OS 10.2.4-h4",
"PAN-OS 10.2.4-h3",
"PAN-OS 10.2.4-h2",
"PAN-OS 10.2.4-h1",
"PAN-OS 10.2.4",
"PAN-OS 10.2.3-h14",
"PAN-OS 10.2.3-h13",
"PAN-OS 10.2.3-h12",
"PAN-OS 10.2.3-h11",
"PAN-OS 10.2.3-h10",
"PAN-OS 10.2.3-h9",
"PAN-OS 10.2.3-h8",
"PAN-OS 10.2.3-h7",
"PAN-OS 10.2.3-h6",
"PAN-OS 10.2.3-h5",
"PAN-OS 10.2.3-h4",
"PAN-OS 10.2.3-h3",
"PAN-OS 10.2.3-h2",
"PAN-OS 10.2.3-h1",
"PAN-OS 10.2.3",
"PAN-OS 10.2.2-h6",
"PAN-OS 10.2.2-h5",
"PAN-OS 10.2.2-h4",
"PAN-OS 10.2.2-h3",
"PAN-OS 10.2.2-h2",
"PAN-OS 10.2.2-h1",
"PAN-OS 10.2.2",
"PAN-OS 10.2.1-h3",
"PAN-OS 10.2.1-h2",
"PAN-OS 10.2.1-h1",
"PAN-OS 10.2.1",
"PAN-OS 10.2.0-h4",
"PAN-OS 10.2.0-h3",
"PAN-OS 10.2.0-h2",
"PAN-OS 10.2.0-h1",
"PAN-OS 10.2.0"
],
"x_cpeGeneratedAt": "2026-08-12T02:10:58.323Z",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0301",
"datePublished": "2026-08-13T02:05:25.118Z",
"dateReserved": "2025-11-03T20:44:59.306Z",
"dateUpdated": "2026-08-14T18:27:26.549Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0299 (GCVE-0-2026-0299)
Vulnerability from nvd – Published: 2026-08-13 02:04 – Updated: 2026-08-13 13:21
VLAI
EPSS
VEX
Title
GlobalProtect App: Local Privilege Escalation Vulnerabilities
Summary
Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
The GlobalProtect app on iOS, Android, and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 03:55 UTC
CWE
- CWE-426 - Untrusted Search Path
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0299 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h15
(custom)
Affected: 6.2.0 (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h14
(custom)
Affected: 6.2.0 , < 6.2.8-h13 (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Unaffected:
All
(custom)
|
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0299",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T03:55:52.857599Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:21:02.891Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"macOS",
"Windows"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h14",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h14",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.8-h13",
"status": "unaffected"
}
],
"lessThan": "6.2.8-h13",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"iOS",
"Android",
"Chrome OS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h14",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h14",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.2.8-h13",
"versionStartIncluding": "6.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.2.8-h13",
"versionStartIncluding": "6.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:ios:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:android:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:chrome_os:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "our internal security research teams"
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect\u2122 app enable a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\u003cbr\u003e\u003cbr\u003eThe GlobalProtect app on iOS, Android, and Chrome OS is not affected."
}
],
"value": "Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect\u2122 app enable a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\nThe GlobalProtect app on iOS, Android, and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426 Untrusted Search Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T02:04:07.275Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0299"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.3/6.2 on Linux\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.3.3-h14\u003cbr\u003e \u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.0 on Linux\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.3 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.3.0 through\u0026nbsp;6.3.3-h13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h14\u0026nbsp;\u003cspan\u003e(6.3.3-1121) \u003c/span\u003e or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.3 on Windows\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.3.0 through\u0026nbsp;6.3.3-h13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h14 \u003cspan\u003e(6.3.3-1121) \u003c/span\u003eor later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through\u0026nbsp;6.2.8-h12\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.2.8-h13\u0026nbsp;(6.2.8-1045) or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2 on Windows\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through\u0026nbsp;6.2.8-h12\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.2.8-h13 (6.2.8-1045) or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.0 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.0 on Windows\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on iOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Android\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Chrome OS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nGlobalProtect App 6.3/6.2 on Linux 6.2.0 through 6.3.3-h14 Upgrade to 6.3.3-h15 or later.\nGlobalProtect App 6.0 on Linux 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\nGlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\nGlobalProtect App 6.0 on macOS 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App 6.0 on Windows 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App on iOS No action needed.\nGlobalProtect App on Android No action needed.\nGlobalProtect App on Chrome OS No action needed."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial Publication."
}
],
"title": "GlobalProtect App: Local Privilege Escalation Vulnerabilities",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"GlobalProtect App 6.3.3",
"GlobalProtect App 6.3.2",
"GlobalProtect App 6.3.1",
"GlobalProtect App 6.3.0",
"GlobalProtect App 6.3",
"GlobalProtect App 6.2.9",
"GlobalProtect App 6.2.8-c982",
"GlobalProtect App 6.2.8-c948",
"GlobalProtect App 6.2.8-c910",
"GlobalProtect App 6.2.8-c471",
"GlobalProtect App 6.2.8-c431",
"GlobalProtect App 6.2.8-c416",
"GlobalProtect App 6.2.8-c317",
"GlobalProtect App 6.2.8-c263",
"GlobalProtect App 6.2.8-c243",
"GlobalProtect App 6.2.8",
"GlobalProtect App 6.2.7",
"GlobalProtect App 6.2.6",
"GlobalProtect App 6.2.4",
"GlobalProtect App 6.2.3",
"GlobalProtect App 6.2.2",
"GlobalProtect App 6.2.1",
"GlobalProtect App 6.2.0",
"GlobalProtect App 6.2",
"GlobalProtect App 6.0.14",
"GlobalProtect App 6.0.13",
"GlobalProtect App 6.0.12",
"GlobalProtect App 6.0.11",
"GlobalProtect App 6.0.10",
"GlobalProtect App 6.0.8",
"GlobalProtect App 6.0.7",
"GlobalProtect App 6.0.6",
"GlobalProtect App 6.0.5",
"GlobalProtect App 6.0.4",
"GlobalProtect App 6.0.3",
"GlobalProtect App 6.0.2",
"GlobalProtect App 6.0.1",
"GlobalProtect App 6.0.0",
"GlobalProtect App 6.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0299",
"datePublished": "2026-08-13T02:04:07.275Z",
"dateReserved": "2025-11-03T20:44:57.175Z",
"dateUpdated": "2026-08-13T13:21:02.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0298 (GCVE-0-2026-0298)
Vulnerability from nvd – Published: 2026-08-13 02:02 – Updated: 2026-08-13 13:20
VLAI
EPSS
VEX
Title
GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)
Summary
An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.
The GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 03:55 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0298 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h14
(custom)
Affected: 6.2.0 , < 6.2.8-h13 (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Unaffected:
All
(custom)
|
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0298",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T03:55:53.877148Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:20:48.963Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h14",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h14",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.8-h13",
"status": "unaffected"
}
],
"lessThan": "6.2.8-h13",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"macOS",
"Android",
"Chrome OS",
"iOS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eThis issue is applicable only to devices configured to use SAML authentication in the GlobalProtect\u003c/span\u003e \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method\"\u003e\u003cspan\u003eConnect Before Logon\u003c/span\u003e\u003c/a\u003e\u003cspan\u003e feature.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "This issue is applicable only to devices configured to use SAML authentication in the GlobalProtect Connect Before Logon (https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method) feature."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h14",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.2.8-h13",
"versionStartIncluding": "6.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:linux:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:macos:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:android:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:chrome_os:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:ios:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "our internal security research teams"
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect\u2122 app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.\u003cbr\u003e\u003cbr\u003eThe GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected."
}
],
"value": "An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect\u2122 app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an affected client.\n\nThe GlobalProtect app on Linux, macOS, iOS, Android, and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T02:02:47.196Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0298"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.3 on Windows\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.3.0 through 6.3.3-h13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h14\u0026nbsp;(6.3.3-1121) or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2 on Windows\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.2.8-h12\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.2.8-h13\u0026nbsp;(6.2.8-1045) or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.0 on Windows\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App All on macOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App All on Linux\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App All on iOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App All on Android\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App All on Chrome OS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nGlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\nGlobalProtect App 6.0 on Windows 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App All on macOS No action needed.\nGlobalProtect App All on Linux No action needed.\nGlobalProtect App All on iOS No action needed.\nGlobalProtect App All on Android No action needed.\nGlobalProtect App All on Chrome OS No action needed."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eCustomers can mitigate the risk of this issue by taking either of the following actions:\u003c/span\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cp\u003e\u003cspan\u003eUse\u0026nbsp;\u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method\"\u003e\u003cspan\u003eConnect Before Logon (CBL\u003c/span\u003e\u003c/a\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method\"\u003e\u003cspan\u003e)\u003c/span\u003e\u003c/a\u003e\u0026nbsp;\u003cspan\u003ewithout SAML Authentication\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cspan\u003eUse\u0026nbsp;\u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-quick-configs/remote-access-vpn-with-pre-logon\"\u003e\u003cspan\u003ePre-logon with machine certificate\u003c/span\u003e\u003c/a\u003e\u0026nbsp;\u003cspan\u003einstead of Connect Before Logon (CBL).\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003e"
}
],
"value": "Customers can mitigate the risk of this issue by taking either of the following actions:\n\n 1. Use Connect Before Logon (CBL (https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method)) (https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method) without SAML Authentication\n\n 2. Use Pre-logon with machine certificate (https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-quick-configs/remote-access-vpn-with-pre-logon) instead of Connect Before Logon (CBL)."
}
],
"x_affectedList": [
"GlobalProtect App 6.3.3",
"GlobalProtect App 6.3.2",
"GlobalProtect App 6.3.1",
"GlobalProtect App 6.3.0",
"GlobalProtect App 6.3",
"GlobalProtect App 6.2.8",
"GlobalProtect App 6.2.7",
"GlobalProtect App 6.2.6",
"GlobalProtect App 6.2.4",
"GlobalProtect App 6.2.3",
"GlobalProtect App 6.2.2",
"GlobalProtect App 6.2.1",
"GlobalProtect App 6.2.0",
"GlobalProtect App 6.2",
"GlobalProtect App 6.0.14",
"GlobalProtect App 6.0.13",
"GlobalProtect App 6.0.12",
"GlobalProtect App 6.0.11",
"GlobalProtect App 6.0.10",
"GlobalProtect App 6.0.8",
"GlobalProtect App 6.0.7",
"GlobalProtect App 6.0.6",
"GlobalProtect App 6.0.5",
"GlobalProtect App 6.0.4",
"GlobalProtect App 6.0.3",
"GlobalProtect App 6.0.2",
"GlobalProtect App 6.0.1",
"GlobalProtect App 6.0.0",
"GlobalProtect App 6.0"
],
"x_cpeGeneratedAt": "2026-08-12T02:10:58.226Z",
"x_cpeManuallyEdited": true,
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0298",
"datePublished": "2026-08-13T02:02:47.196Z",
"dateReserved": "2025-11-03T20:44:56.118Z",
"dateUpdated": "2026-08-13T13:20:48.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0297 (GCVE-0-2026-0297)
Vulnerability from nvd – Published: 2026-08-13 02:01 – Updated: 2026-08-13 13:20
VLAI
EPSS
VEX
Title
GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake
Summary
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, and root privileges on macOS and Linux).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 03:55 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0297 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h15
(custom)
Affected: 6.2.0 (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h14
(custom)
Affected: 6.2.0 , < 6.2.8-h13 (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.5
(custom)
Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Chrome_OS:*:* |
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0297",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T03:55:54.896353Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:20:35.603Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"macOS",
"Windows"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h14",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h14",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.8-h13",
"status": "unaffected"
}
],
"lessThan": "6.2.8-h13",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Chrome_OS:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"iOS",
"Android",
"Chrome OS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.5",
"status": "unaffected"
}
],
"lessThan": "6.3.5",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eNo special configuration is required to be affected by this issue.\u003c/span\u003e"
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h14",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h14",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.2.8-h13",
"versionStartIncluding": "6.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.2.8-h13",
"versionStartIncluding": "6.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:ios:*:*:*:*:*",
"versionEndExcluding": "6.3.5",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:android:*:*:*:*:*",
"versionEndExcluding": "6.3.5",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:chrome_os:*:*:*:*:*",
"versionEndExcluding": "6.3.5",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:ios:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:android:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:chrome_os:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "our internal security research teams"
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect\u2122 app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, and root privileges on macOS and Linux). \u003c/p\u003e"
}
],
"value": "A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect\u2122 app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, and root privileges on macOS and Linux)."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T02:01:13.682Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0297"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.3/6.2 on Linux\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.3.3-h14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.0 on Linux\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.3 on macOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e6.3.0 through 6.3.3-h13\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 6.3.3-h14\u0026nbsp;(6.3.3-1121) or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.2 on macOS\u003c/td\u003e\u003ctd\u003e6.2.0 through 6.2.8-h12\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 6.2.8-h13\u0026nbsp;(6.2.8-1045) or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.0 on macOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.3 on Windows\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e6.3.0 through 6.3.3-h13\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 6.3.3-h14 (6.3.3-1121) or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.2 on Windows\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e6.2.0 through 6.2.8-h12\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 6.2.8-h13 (6.2.8-1045) or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.0 on Windows\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.3/6.1 on iOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e6.1.0 through 6.3.4\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 6.3.5 or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.0 on iOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.3/6.1 on Android\u003c/td\u003e\u003ctd\u003e6.1.0 through 6.3.4\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 6.3.5 or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.0 on Android\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.3/6.1 on ChromeOS\u003c/td\u003e\u003ctd\u003e6.1.0 through 6.3.4\u003c/td\u003e\u003ctd\u003eUpgrade to 6.3.5 or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.0 on ChromeOS\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nGlobalProtect App 6.3/6.2 on Linux 6.2.0 through 6.3.3-h14 Upgrade to 6.3.3-h15 or later.\nGlobalProtect App 6.0 on Linux 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\nGlobalProtect App 6.0 on macOS 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\nGlobalProtect App 6.0 on Windows 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later. \nGlobalProtect App 6.3/6.1 on iOS 6.1.0 through 6.3.4 Upgrade to 6.3.5 or later.\nGlobalProtect App 6.0 on iOS 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App 6.3/6.1 on Android 6.1.0 through 6.3.4 Upgrade to 6.3.5 or later.\nGlobalProtect App 6.0 on Android 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App 6.3/6.1 on ChromeOS 6.1.0 through 6.3.4 Upgrade to 6.3.5 or later.\nGlobalProtect App 6.0 on ChromeOS 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial Publication."
}
],
"title": "GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers can mitigate the risk of this issue by taking either of the following three actions:\u003cbr\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cp\u003eEnforce SSL-Only VPN Connections:\u0026nbsp;Modify your GlobalProtect Portal configurations to disable IPSec/UDP tunneling, forcing the client applications to connect exclusively via SSL VPN mode.\u0026nbsp;Customer can configure \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-portals/customize-the-globalprotect-app\"\u003eConnect with SSL Only\u003c/a\u003e tunnel by configuring \u0027 Advanced Control for Tunnel Mode Behavior\u0027 on GlobalProtect Portal Network \u0026gt; Portal \u0026gt; Agent Configuration\u0026gt; Advanced Control for Tunnel Mode Behavior\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eCustomers can configure SSL only tunnel protocol by un-checking \u0027\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/help/10-2/globalprotect/network-globalprotect-gateways/globalprotect-gateways-agent-tab/tunnel-settings-tab\"\u003eEnable IPSec\u003c/a\u003e\u0027 on GlobalProtect gateway at\u003cb\u003e\u0026nbsp;\u003c/b\u003e\u003cb\u003eNetwork\u003c/b\u003e \u0026gt; \u003cb\u003eGateway\u003c/b\u003e\u003cb\u003e \u003c/b\u003e\u0026gt;\u003cb\u003e \u003c/b\u003e\u003cb\u003eAgent \u003c/b\u003e\u0026gt; \u003cb\u003eTunnel Setting\u003c/b\u003e \u0026gt; \u003cb\u003eEnable IPSec\u003c/b\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u003cb\u003eWorkaround\u0026nbsp; for new and existing GlobalProtect app \u0026gt;= 6.2.8 or GlobalProtect app \u0026gt;= 6.3.3 installations on Windows and macOS\u003c/b\u003e \u003cbr\u003eGlobalProtect 6.2.8 and GlobalProtect app 6.3.3 on Windows and macOS introduce a new configuration\u0026nbsp;\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/platform-explorer?productCategoryTags=pan%3Aproductcategory%2Fglobalprotect\"\u003eEnable Strict Certificate Check\u003c/a\u003e which enables certificate checks required to mitigate this issue on Windows and macOS.\u003cbr\u003e\u003cbr\u003eThis configuration only takes effect after the first connection between the GlobalProtect client and the GlobalProtect portal. Therefore the first connection is not protected. To ensure that the first connection is also protected, additionally follow the steps noted below for GlobalProtect \u0026lt; 6.2.8.\u003cbr\u003eThis configuration option is currently not available for the GlobalProtect app on platforms other than Windows and macOS.\u003cbr\u003e\u003cbr\u003e\u003cb\u003eWorkaround for new and existing GlobalProtect app \u0026lt; 6.2.8 or GlobalProtect app \u0026lt; 6.3.3 installations on macOS\u003c/b\u003e\u003cbr\u003e\u003cb\u003e\u003c/b\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-apps/deploy-app-settings-transparently/deploy-app-settings-to-mac-endpoints/deploy-app-settings-in-the-mac-plist\"\u003eUse Xcode to edit the com.paloaltonetworks.GlobalProtect.settings.plist file\u003c/a\u003e\u0026nbsp;in /Library/Preferences.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eAdd a \"Settings\" section if it does not exist within the GlobalProtect section.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eWithin the \"Settings\" section, add the full-chain-cert-verify key and set the string value to yes\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003e\u0026nbsp;Restart macOS.\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003e\u003ctt\u003e\u003ctt\u003e\u2003\u0026lt;key\u0026gt;GlobalProtect\u0026lt;/key\u0026gt;\u003c/tt\u003e\u003cbr\u003e\u003ctt\u003e\u2003\u0026lt;dict\u0026gt;\u003c/tt\u003e\u003cbr\u003e\u003ctt\u003e\u003ctt\u003e\u0026nbsp; \u2003\u0026nbsp; (removed for brevity)\u003c/tt\u003e\u003c/tt\u003e\u003cbr\u003e\u003ctt\u003e\u0026nbsp; \u0026nbsp;\u2003 \u0026lt;key\u0026gt;Settings\u0026lt;/key\u0026gt;\u003c/tt\u003e\u003cbr\u003e\u003ctt\u003e\u0026nbsp; \u2003\u0026nbsp;\u0026lt;dict\u0026gt;\u003c/tt\u003e\u003cbr\u003e\u003ctt\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp;\u2003 \u0026nbsp; \u0026lt;key\u0026gt;full-chain-cert-verify\u0026lt;/key\u0026gt;\u003c/tt\u003e\u003cbr\u003e\u003ctt\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp;\u2003 \u0026nbsp; \u0026lt;string\u0026gt;yes\u0026lt;/string\u0026gt;\u003cbr\u003e\u003c/tt\u003e\u0026nbsp; \u0026nbsp;\u2003\u0026lt;/dict\u0026gt;\u003cbr\u003e\u0026lt;/dict\u0026gt;\u003c/tt\u003e\u003c/li\u003e\u003c/ol\u003e\u003cb\u003e\u2003\u2003\u2003Workaround for new and existing GlobalProtect app installations on Linux\u003cbr\u003e\u003c/b\u003e\u2003\u2003\u2003\u2003\u20031. Create the /opt/paloaltonetworks/globalprotect/pangps.xml pre-deployment configuration file.\u003cbr\u003e\u2003\u2003\u2003\u2003\u20032. Add the pre-deployment settings to the pangps.xml file\u003cbr\u003e\u003ctt\u003e\u2003\u2003\u2003\u003cbr\u003e\u2003\u2003\u2003\u2003\u2003\u2003\u0026lt;GlobalProtect\u0026gt;\u003cbr\u003e\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u0026lt;Settings\u0026gt;\u003cbr\u003e\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u0026lt;full-chain-cert-verify\u0026gt;yes\u0026lt;/full-chain-cert-verify\u0026gt;\u003cbr\u003e\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u0026lt;/Settings\u003cbr\u003e\u2003\u2003\u2003\u2003\u2003\u2003\u0026lt;/GlobalProtect\u0026gt;\u003c/tt\u003e\u003cp\u003e\u003cbr\u003e\u003cb\u003e\u2003\u2003\u2003\u2003Workaround for new and existing GlobalProtect app installations on Android, iOS and ChromeOS\u003c/b\u003e\u003cbr\u003e\u2003\u2003\u2003\u2003Customers can use their endpoint mobile device management (MDM) tools to apply the following changes\u003cbr\u003e\u2003\u2003\u2003\u2003\u2003\u20031. Set the key \"full-chain-cert-verify\"=\"yes\".\u003c/p\u003e\u003cb\u003e\u003c/b\u003e"
}
],
"value": "Customers can mitigate the risk of this issue by taking either of the following three actions:\n\n\n 1. Enforce SSL-Only VPN Connections: Modify your GlobalProtect Portal configurations to disable IPSec/UDP tunneling, forcing the client applications to connect exclusively via SSL VPN mode. Customer can configure Connect with SSL Only (https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-portals/customize-the-globalprotect-app) tunnel by configuring \u0027 Advanced Control for Tunnel Mode Behavior\u0027 on GlobalProtect Portal Network \u003e Portal \u003e Agent Configuration\u003e Advanced Control for Tunnel Mode Behavior\n\n 2. Customers can configure SSL only tunnel protocol by un-checking \u0027Enable IPSec (https://docs.paloaltonetworks.com/ngfw/help/10-2/globalprotect/network-globalprotect-gateways/globalprotect-gateways-agent-tab/tunnel-settings-tab)\u0027 on GlobalProtect gateway at Network \u003e Gateway \u003e Agent \u003e Tunnel Setting \u003e Enable IPSec\n\n 3. Workaround for new and existing GlobalProtect app \u003e= 6.2.8 or GlobalProtect app \u003e= 6.3.3 installations on Windows and macOS\n GlobalProtect 6.2.8 and GlobalProtect app 6.3.3 on Windows and macOS introduce a new configuration Enable Strict Certificate Check (https://docs.paloaltonetworks.com/platform-explorer?productCategoryTags=pan%3Aproductcategory%2Fglobalprotect) which enables certificate checks required to mitigate this issue on Windows and macOS.\n \n This configuration only takes effect after the first connection between the GlobalProtect client and the GlobalProtect portal. Therefore the first connection is not protected. To ensure that the first connection is also protected, additionally follow the steps noted below for GlobalProtect \u003c 6.2.8.\n This configuration option is currently not available for the GlobalProtect app on platforms other than Windows and macOS.\n \n Workaround for new and existing GlobalProtect app \u003c 6.2.8 or GlobalProtect app \u003c 6.3.3 installations on macOS\n \n \n 1. Use Xcode to edit the com.paloaltonetworks.GlobalProtect.settings.plist file (https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-apps/deploy-app-settings-transparently/deploy-app-settings-to-mac-endpoints/deploy-app-settings-in-the-mac-plist) in /Library/Preferences.\n \n 2. Add a \"Settings\" section if it does not exist within the GlobalProtect section.\n \n 3. Within the \"Settings\" section, add the full-chain-cert-verify key and set the string value to yes\n \n 4. Restart macOS.\n \u2003\u003ckey\u003eGlobalProtect\u003c/key\u003e\n \u2003\u003cdict\u003e\n \u2003 (removed for brevity)\n \u2003 \u003ckey\u003eSettings\u003c/key\u003e\n \u2003 \u003cdict\u003e\n \u2003 \u003ckey\u003efull-chain-cert-verify\u003c/key\u003e\n \u2003 \u003cstring\u003eyes\u003c/string\u003e\n \u2003\u003c/dict\u003e\n \u003c/dict\u003e\n\n\u2003\u2003\u2003Workaround for new and existing GlobalProtect app installations on Linux\n\u2003\u2003\u2003\u2003\u20031. Create the /opt/paloaltonetworks/globalprotect/pangps.xml pre-deployment configuration file.\n\u2003\u2003\u2003\u2003\u20032. Add the pre-deployment settings to the pangps.xml file\n\u2003\u2003\u2003\n\u2003\u2003\u2003\u2003\u2003\u2003\u003cGlobalProtect\u003e\n\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u003cSettings\u003e\n\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u003cfull-chain-cert-verify\u003eyes\u003c/full-chain-cert-verify\u003e\n\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u003c/Settings\n\u2003\u2003\u2003\u2003\u2003\u2003\u003c/GlobalProtect\u003e\n\n\n\u2003\u2003\u2003\u2003Workaround for new and existing GlobalProtect app installations on Android, iOS and ChromeOS\n\u2003\u2003\u2003\u2003Customers can use their endpoint mobile device management (MDM) tools to apply the following changes\n\u2003\u2003\u2003\u2003\u2003\u20031. Set the key \"full-chain-cert-verify\"=\"yes\"."
}
],
"x_affectedList": [
"GlobalProtect App 6.3.3",
"GlobalProtect App 6.3.2",
"GlobalProtect App 6.3.1",
"GlobalProtect App 6.3.0",
"GlobalProtect App 6.3",
"GlobalProtect App 6.2.9",
"GlobalProtect App 6.2.8-c982",
"GlobalProtect App 6.2.8-c948",
"GlobalProtect App 6.2.8-c910",
"GlobalProtect App 6.2.8-c471",
"GlobalProtect App 6.2.8-c431",
"GlobalProtect App 6.2.8-c416",
"GlobalProtect App 6.2.8-c317",
"GlobalProtect App 6.2.8-c263",
"GlobalProtect App 6.2.8-c243",
"GlobalProtect App 6.2.8",
"GlobalProtect App 6.2.7",
"GlobalProtect App 6.2.6",
"GlobalProtect App 6.2.4",
"GlobalProtect App 6.2.3",
"GlobalProtect App 6.2.2",
"GlobalProtect App 6.2.1",
"GlobalProtect App 6.2.0",
"GlobalProtect App 6.2",
"GlobalProtect App 6.0.14",
"GlobalProtect App 6.0.13",
"GlobalProtect App 6.0.12",
"GlobalProtect App 6.0.11",
"GlobalProtect App 6.0.10",
"GlobalProtect App 6.0.8",
"GlobalProtect App 6.0.7",
"GlobalProtect App 6.0.6",
"GlobalProtect App 6.0.5",
"GlobalProtect App 6.0.4",
"GlobalProtect App 6.0.3",
"GlobalProtect App 6.0.2",
"GlobalProtect App 6.0.1",
"GlobalProtect App 6.0.0",
"GlobalProtect App 6.0"
],
"x_cpeGeneratedAt": "2026-08-12T02:10:58.171Z",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0297",
"datePublished": "2026-08-13T02:01:13.682Z",
"dateReserved": "2025-11-03T20:44:54.801Z",
"dateUpdated": "2026-08-13T13:20:35.603Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0296 (GCVE-0-2026-0296)
Vulnerability from nvd – Published: 2026-08-13 01:59 – Updated: 2026-08-13 13:29
VLAI
EPSS
VEX
Title
GlobalProtect App: Improper Certificate Validation Bypass Vulnerability
Summary
Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted.
The GlobalProtect app on iOS, Android, and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:29 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0296 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h15
(custom)
Affected: 6.2.0 (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h14
(custom)
Affected: 6.2.0 , < 6.2.8-h13 (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Unaffected:
All
(custom)
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Chrome_OS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Chrome_OS:*:* |
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0296",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:29:34.520951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:29:46.735Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.9:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c982:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c948:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c910:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c471:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c431:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c416:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c317:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c263:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8-c243:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"macOS",
"Windows"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h14",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h14",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.8-h13",
"status": "unaffected"
}
],
"lessThan": "6.2.8-h13",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Chrome_OS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Chrome_OS:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"iOS",
"Android",
"Chrome OS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:linux:*:*:*:*:*",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h14",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h14",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.2.8-h13",
"versionStartIncluding": "6.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.2.8-h13",
"versionStartIncluding": "6.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:ios:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:android:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:chrome_os:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "our internal security research teams"
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003c/p\u003e\u003cspan\u003eImproper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect\u2122 app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted.\u003c/span\u003e\u003cb\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/b\u003e\u003cspan\u003eThe GlobalProtect app on iOS, Android, and Chrome OS is not affected.\u003c/span\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect\u2122 app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted.\n\nThe GlobalProtect app on iOS, Android, and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Man in the Middle Attack"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T01:59:45.972Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0296"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\n \u003cthead\u003e\n \u003ctr\u003e\n \u003cth\u003eVersion\u003c/th\u003e\n \u003cth\u003eMinor Version\u003c/th\u003e\n \u003cth\u003eSuggested Solution\u003c/th\u003e\n \u003c/tr\u003e\n \u003c/thead\u003e\n \u003ctbody\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.3/6.2 on Linux\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.3.3-h14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h15 or later.\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.0 on Linux\u003c/td\u003e\n \u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.3 on macOS\u003c/td\u003e\n \u003ctd\u003e6.3.0 through 6.3.3-h13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h14 (6.3.3-1121) or later.\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2 on macOS\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.2.8-h12\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.2.8-h13 (6.2.8-1045) or later.\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.0 on macOS\u003c/td\u003e\n \u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.3 on Windows\u003c/td\u003e\n \u003ctd\u003e6.3.0 through 6.3.3-h13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h14 (6.3.3-1121) or later.\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2 on Windows\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.2.8-h12\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.2.8-h13 (6.2.8-1045) or later.\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.0 on Windows\u003c/td\u003e\n \u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App on iOS\u003c/td\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003eNo action needed.\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App on Android\u003c/td\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003eNo action needed.\u003c/td\u003e\n \u003c/tr\u003e\n \u003ctr\u003e\n \u003ctd\u003eGlobalProtect App on Chrome OS\u003c/td\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003eNo action needed.\u003c/td\u003e\n \u003c/tr\u003e\n \u003c/tbody\u003e\n\u003c/table\u003e"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nGlobalProtect App 6.3/6.2 on Linux 6.2.0 through 6.3.3-h14 Upgrade to 6.3.3-h15 or later.\nGlobalProtect App 6.0 on Linux 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\nGlobalProtect App 6.0 on macOS 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\nGlobalProtect App 6.0 on Windows 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App on iOS No action needed.\nGlobalProtect App on Android No action needed.\nGlobalProtect App on Chrome OS No action needed."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial Publication."
}
],
"title": "GlobalProtect App: Improper Certificate Validation Bypass Vulnerability",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds or mitigations exist for this issue."
}
],
"value": "No known workarounds or mitigations exist for this issue."
}
],
"x_affectedList": [
"GlobalProtect App 6.3.3",
"GlobalProtect App 6.3.2",
"GlobalProtect App 6.3.1",
"GlobalProtect App 6.3.0",
"GlobalProtect App 6.3",
"GlobalProtect App 6.2.9",
"GlobalProtect App 6.2.8-c982",
"GlobalProtect App 6.2.8-c948",
"GlobalProtect App 6.2.8-c910",
"GlobalProtect App 6.2.8-c471",
"GlobalProtect App 6.2.8-c431",
"GlobalProtect App 6.2.8-c416",
"GlobalProtect App 6.2.8-c317",
"GlobalProtect App 6.2.8-c263",
"GlobalProtect App 6.2.8-c243",
"GlobalProtect App 6.2.8",
"GlobalProtect App 6.2.7",
"GlobalProtect App 6.2.6",
"GlobalProtect App 6.2.4",
"GlobalProtect App 6.2.3",
"GlobalProtect App 6.2.2",
"GlobalProtect App 6.2.1",
"GlobalProtect App 6.2.0",
"GlobalProtect App 6.2",
"GlobalProtect App 6.0.14",
"GlobalProtect App 6.0.13",
"GlobalProtect App 6.0.12",
"GlobalProtect App 6.0.11",
"GlobalProtect App 6.0.10",
"GlobalProtect App 6.0.8",
"GlobalProtect App 6.0.7",
"GlobalProtect App 6.0.6",
"GlobalProtect App 6.0.5",
"GlobalProtect App 6.0.4",
"GlobalProtect App 6.0.3",
"GlobalProtect App 6.0.2",
"GlobalProtect App 6.0.1",
"GlobalProtect App 6.0.0",
"GlobalProtect App 6.0"
],
"x_cpeGeneratedAt": "2026-08-12T02:10:58.092Z",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0296",
"datePublished": "2026-08-13T01:59:45.972Z",
"dateReserved": "2025-11-03T20:44:53.961Z",
"dateUpdated": "2026-08-13T13:29:46.735Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0295 (GCVE-0-2026-0295)
Vulnerability from nvd – Published: 2026-08-13 01:57 – Updated: 2026-08-13 13:20
VLAI
EPSS
VEX
Title
GlobalProtect App: Local Privilege Escalation via Race Condition on macOS
Summary
A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.
The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 03:55 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0295 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h14 (6.3.3-1121)
(custom)
Affected: 6.2.0 , < 6.2.8-h13 (6.2.8-1045) (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Unaffected:
All
(custom)
|
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0295",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T03:55:55.918274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:20:22.119Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.2.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"macOS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h14",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h14 (6.3.3-1121)",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.8-h13",
"status": "unaffected"
}
],
"lessThan": "6.2.8-h13 (6.2.8-1045)",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"Windows",
"iOS",
"Android",
"Chrome OS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h14_6.3.3-1121_",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.2.8-h13_6.2.8-1045_",
"versionStartIncluding": "6.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:linux:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:windows:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:ios:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:android:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:all:*:chrome_os:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alex Bourla and Graham Brereton"
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A race condition in the Palo Alto Networks GlobalProtect\u2122 client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.\u003cbr\u003e\u003cbr\u003eThe GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected."
}
],
"value": "A race condition in the Palo Alto Networks GlobalProtect\u2122 client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root.\n\nThe GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-29",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T01:57:22.394Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0295"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.3 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.3.0 through 6.3.3-h13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h14 (6.3.3-1121) or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.2.8-h12\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.2.8-h13 (6.2.8-1045) or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;GlobalProtect App 6.0 on macOS\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Linux\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Windows\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on iOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Android\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Chrome OS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nGlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later.\nGlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (6.2.8-1045) or later.\n GlobalProtect App 6.0 on macOS 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later.\nGlobalProtect App on Linux No action needed.\nGlobalProtect App on Windows No action needed.\nGlobalProtect App on iOS No action needed.\nGlobalProtect App on Android No action needed.\nGlobalProtect App on Chrome OS No action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "GlobalProtect App: Local Privilege Escalation via Race Condition on macOS",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds or mitigations exist for this issue.\u0026nbsp;"
}
],
"value": "No known workarounds or mitigations exist for this issue."
}
],
"x_affectedList": [
"GlobalProtect App 6.3.3",
"GlobalProtect App 6.3.2",
"GlobalProtect App 6.3.1",
"GlobalProtect App 6.3.0",
"GlobalProtect App 6.3",
"GlobalProtect App 6.2.8",
"GlobalProtect App 6.2.7",
"GlobalProtect App 6.2.6",
"GlobalProtect App 6.2.4",
"GlobalProtect App 6.2.3",
"GlobalProtect App 6.2.2",
"GlobalProtect App 6.2.1",
"GlobalProtect App 6.2.0",
"GlobalProtect App 6.2",
"GlobalProtect App 6.0.14",
"GlobalProtect App 6.0.13",
"GlobalProtect App 6.0.12",
"GlobalProtect App 6.0.11",
"GlobalProtect App 6.0.10",
"GlobalProtect App 6.0.8",
"GlobalProtect App 6.0.7",
"GlobalProtect App 6.0.6",
"GlobalProtect App 6.0.5",
"GlobalProtect App 6.0.4",
"GlobalProtect App 6.0.3",
"GlobalProtect App 6.0.2",
"GlobalProtect App 6.0.1",
"GlobalProtect App 6.0.0",
"GlobalProtect App 6.0"
],
"x_cpeGeneratedAt": "2026-08-12T02:10:58.042Z",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0295",
"datePublished": "2026-08-13T01:57:22.394Z",
"dateReserved": "2025-11-03T20:44:53.142Z",
"dateUpdated": "2026-08-13T13:20:22.119Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0294 (GCVE-0-2026-0294)
Vulnerability from nvd – Published: 2026-08-13 01:54 – Updated: 2026-08-13 13:29
VLAI
EPSS
VEX
Title
Prisma Access Agent: Local Privilege Escalation
Summary
A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges.
The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:28 UTC
CWE
- CWE-427 - Uncontrolled Search Path Element
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0294 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Prisma Access Agent |
Affected:
0 , < 26.3
(custom)
cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:windows:*:*:*:*:* cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:macos:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access Agent |
Unaffected:
All
(custom)
|
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:28:49.469059Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:29:18.678Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"macOS"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "26.3",
"status": "unaffected"
}
],
"lessThan": "26.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"iOS",
"Android",
"Chrome OS"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "26.3",
"versionStartIncluding": "24.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "26.3",
"versionStartIncluding": "24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:all:*:linux:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:all:*:ios:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:all:*:android:*:*:*:*:*",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:all:*:chrome_os:*:*:*:*:*",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Garrison of State Farm Information Security"
},
{
"lang": "en",
"type": "finder",
"value": "KBTG Cybersecurity Researcher Engineers: Nuttakorn Tungpoonsup, Jirawat Siengphao, Khanatip Vanjongkham, and Waris Damkham"
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma\u00ae Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. \u003cb\u003e\u003cbr\u003e\u003cbr\u003e\u003c/b\u003eThe Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected."
}
],
"value": "A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma\u00ae Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. \n\nThe Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "AUTOMATIC",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:C/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-427",
"description": "CWE-427: Uncontrolled Search Path Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T01:54:03.387Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0294"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Access Agent on Windows\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e 24.0\u003cb\u003e\u0026nbsp;\u003c/b\u003ethrough 26.2.2\u003c/td\u003e\n \u003ctd\u003eUpgrade to 26.3 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Access Agent on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e 24.0 through 26.2.2\u003c/td\u003e\n \u003ctd\u003eUpgrade to 26.3 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Linux\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on iOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Android\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Chrome OS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Windows 24.0 through 26.2.2 Upgrade to 26.3 or later.\nPrisma Access Agent on macOS 24.0 through 26.2.2 Upgrade to 26.3 or later.\nPrisma Access Agent on Linux No action needed.\nPrisma Access Agent on iOS No action needed.\nPrisma Access Agent on Android No action needed.\nPrisma Access Agent on Chrome OS No action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial publication."
}
],
"title": "Prisma Access Agent: Local Privilege Escalation",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eNo known workarounds exist for this issue.\u003c/span\u003e"
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0294",
"datePublished": "2026-08-13T01:54:03.387Z",
"dateReserved": "2025-11-03T20:44:52.281Z",
"dateUpdated": "2026-08-13T13:29:18.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0293 (GCVE-0-2026-0293)
Vulnerability from nvd – Published: 2026-08-13 01:51 – Updated: 2026-08-13 13:27
VLAI
EPSS
VEX
Title
Prisma Access Agent: Anti-Tamper Protection Bypass on Windows
Summary
A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files.
The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:27 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0293 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Prisma Access Agent |
Affected:
0 , < 26.3
(custom)
|
|
| Palo Alto Networks | Prisma Access Agent |
Unaffected:
All
(custom)
|
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0293",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:27:26.711967Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:27:50.592Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "26.3",
"status": "unaffected"
}
],
"lessThan": "26.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"macOS",
"iOS",
"Android",
"Chrome OS"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Windows:*:*",
"versionEndExcluding": "26.2.2",
"versionStartIncluding": "24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Palo Alto Networks thanks Daniel Cuthbert and Vladislav Ovitchinikov from Banco Santander for discovering and reporting this issue."
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eA vulnerability in Palo Alto Networks \u003cspan\u003ePrisma\u00ae Access Agent\u003c/span\u003e on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files.\u003c/span\u003e\u003cb\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/b\u003e\u003cspan\u003eThe Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.\u003c/span\u003e"
}
],
"value": "A vulnerability in Palo Alto Networks Prisma\u00ae Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files.\n\nThe Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-159",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-159 Redirect Access to Libraries"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T01:51:07.249Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0293"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Access Agent on Windows\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e24.0 through 26.2.2 \u003c/td\u003e\n \u003ctd\u003eUpgrade to 26.3 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on macOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Linux\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on iOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Android\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Chrome OS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older unsupported versions\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Windows 24.0 through 26.2.2 Upgrade to 26.3 or later.\nPrisma Access Agent on macOS No action needed.\nPrisma Access Agent on Linux No action needed.\nPrisma Access Agent on iOS No action needed.\nPrisma Access Agent on Android No action needed.\nPrisma Access Agent on Chrome OS No action needed.\nAll older unsupported versions Upgrade to a supported fixed version."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial publication."
}
],
"title": "Prisma Access Agent: Anti-Tamper Protection Bypass on Windows",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0293",
"datePublished": "2026-08-13T01:51:07.249Z",
"dateReserved": "2025-11-03T20:44:51.366Z",
"dateUpdated": "2026-08-13T13:27:50.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0292 (GCVE-0-2026-0292)
Vulnerability from nvd – Published: 2026-08-13 01:49 – Updated: 2026-08-13 13:27
VLAI
EPSS
VEX
Title
Prisma Access Agent: Local Security Inspection Bypass Vulnerability on Windows
Summary
An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic.
The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:24 UTC
CWE
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0292 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Prisma Access Agent |
Affected:
0 , < 26.3
(custom)
|
|
| Palo Alto Networks | Prisma Access Agent |
Unaffected:
All
(custom)
|
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0292",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:24:21.943544Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:27:11.458Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "26.3",
"status": "unaffected"
}
],
"lessThan": "26.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"macOS",
"iOS",
"Android",
"Chrome OS"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Windows:*:*",
"versionEndExcluding": "26.2.2",
"versionStartIncluding": "24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Palo Alto Networks thanks KBTG Cybersecurity Researcher Engineers: Nuttakorn Tungpoonsup, Jirawat Siengphao, Khanatip Vanjongkham, and Waris Damkham for discovering and reporting this issue."
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eAn authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma\u00ae Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic.\u003cbr\u003e\u003cbr\u003e\u003cspan\u003eThe Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected.\u003c/span\u003e\u003c/span\u003e"
}
],
"value": "An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma\u00ae Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic.\n\nThe Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-151",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-151 Identity Spoofing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "AUTOMATIC",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:L/E:U/AU:N/R:A/V:C/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T01:49:19.448Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0292"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Access Agent on Windows\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e\u003cspan\u003e24.0 through 26.2.2\u003c/span\u003e \u003c/td\u003e\n \u003ctd\u003eUpgrade to 26.3 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Linux\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on macOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on iOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Android\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Chrome OS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Windows 24.0 through 26.2.2 Upgrade to 26.3 or later.\nPrisma Access Agent on Linux No action needed.\nPrisma Access Agent on macOS No action needed.\nPrisma Access Agent on iOS No action needed.\nPrisma Access Agent on Android No action needed.\nPrisma Access Agent on Chrome OS No action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Prisma Access Agent: Local Security Inspection Bypass Vulnerability on Windows",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0292",
"datePublished": "2026-08-13T01:49:19.448Z",
"dateReserved": "2025-11-03T20:44:49.864Z",
"dateUpdated": "2026-08-13T13:27:11.458Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0291 (GCVE-0-2026-0291)
Vulnerability from nvd – Published: 2026-08-13 01:47 – Updated: 2026-08-13 13:23
VLAI
EPSS
VEX
Title
Prisma Access Agent: Authenticated Limited File Deletion on Linux
Summary
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.
The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:21 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0291 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Prisma Access Agent |
Affected:
0 , < 26.2.2
(custom)
|
|
| Palo Alto Networks | Prisma Access Agent |
Unaffected:
All
(custom)
|
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:21:52.108031Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:23:00.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "26.2.2",
"status": "unaffected"
}
],
"lessThan": "26.2.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"macOS",
"Windows",
"iOS",
"Android",
"Chrome OS"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:*:*:*:Linux:*:*",
"versionEndExcluding": "26.2.2",
"versionStartIncluding": "25.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "an internal reporter"
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eAn improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma\u00ae Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.\u003c/span\u003e\u003cb\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/b\u003e\u003cspan\u003eThe Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.\u003c/span\u003e"
}
],
"value": "An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma\u00ae Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.\n\nThe Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-132",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-132 Symlink Attack"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 1.1,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T01:47:59.370Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0291"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Access Agent on Linux\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e25.7 through 26.2.1 \u003c/td\u003e\n \u003ctd\u003eUpgrade to 26.2.2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on macOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Windows\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on iOS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Android\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Chrome OS\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nPrisma Access Agent on Linux 25.7 through 26.2.1 Upgrade to 26.2.2 or later.\nPrisma Access Agent on macOS No action needed.\nPrisma Access Agent on Windows No action needed.\nPrisma Access Agent on iOS No action needed.\nPrisma Access Agent on Android No action needed.\nPrisma Access Agent on Chrome OS No action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Prisma Access Agent: Authenticated Limited File Deletion on Linux",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds or mitigations exist for this issue."
}
],
"value": "No known workarounds or mitigations exist for this issue."
}
],
"x_affectedList": [
"Prisma Access Agent 26.2.0",
"Prisma Access Agent 26.0",
"Prisma Access Agent 25.0",
"Prisma Access Agent 24.0"
],
"x_cpeGeneratedAt": "2026-08-12T15:37:11.690Z",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0291",
"datePublished": "2026-08-13T01:47:59.370Z",
"dateReserved": "2025-11-03T20:44:48.974Z",
"dateUpdated": "2026-08-13T13:23:00.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0290 (GCVE-0-2026-0290)
Vulnerability from nvd – Published: 2026-08-13 01:45 – Updated: 2026-08-13 13:43
VLAI
EPSS
VEX
Title
Prisma Browser: Sensitive Information Disclosure Vulnerability
Summary
An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:42 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0290 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Prisma Browser |
Affected:
0 , < 148.18.4.217
(custom)
cpe:2.3:a:palo_alto_networks:prisma_browser:*:*:*:*:*:*:*:* |
Date Public
2026-08-12 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0290",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:42:55.618746Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:43:04.567Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Prisma Browser",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "148.18.4.217",
"status": "unaffected"
}
],
"lessThan": "148.18.4.217",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eThis issue is applicable only to Prisma\u00ae Browser with\u0026nbsp;\u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/prisma-access-browser/administration/account-protection-for-the-prisma-browser\"\u003e\u003cspan\u003eAccount Protection\u003c/span\u003e\u003c/a\u003e\u003cspan\u003e enabled.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThis can be verified by checking:\u003c/span\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cspan\u003eNavigate to\u0026nbsp;\u003c/span\u003e\u003cb\u003eLogin Controls\u003c/b\u003e\u0026nbsp;settings\u003c/li\u003e\u003cli\u003e\"\u003cb\u003eActivate account protection\u003c/b\u003e\"\u003cspan\u003e checkbox is enabled\u003c/span\u003e\u003c/li\u003e\u003c/ol\u003e"
}
],
"value": "This issue is applicable only to Prisma\u00ae Browser with Account Protection (https://docs.paloaltonetworks.com/prisma-access-browser/administration/account-protection-for-the-prisma-browser) enabled.\n\nThis can be verified by checking:\n\n 1. Navigate to Login Controls settings\n 2. \"Activate account protection\" checkbox is enabled"
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_browser:*:*:*:*:*:*:*:*",
"versionEndExcluding": "148.18.4.217",
"versionStartIncluding": "148.18.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Palo Alto Networks thanks Thomas Villanueva for discovering and reporting this issue."
}
],
"datePublic": "2026-08-12T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eAn information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma\u00ae Browser enables a local attacker to view sensitive data.\u003c/span\u003e"
}
],
"value": "An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma\u00ae Browser enables a local attacker to view sensitive data."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 0.5,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522 Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T01:45:39.372Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0290"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Browser\u003cbr\u003e\u003c/td\u003e\n \n \u003ctd\u003eUpgrade to 148.18.4.217 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VERSION SUGGESTED SOLUTION\nPrisma Browser Upgrade to 148.18.4.217 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-12T16:00:00.000Z",
"value": "Initial Publication."
}
],
"title": "Prisma Browser: Sensitive Information Disclosure Vulnerability",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"Prisma Browser 148.18.0",
"Prisma Browser 148.18.1",
"Prisma Browser 148.18.2",
"Prisma Browser 148.18.3"
],
"x_cpeGeneratedAt": "2026-08-12T02:10:57.965Z",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0290",
"datePublished": "2026-08-13T01:45:39.372Z",
"dateReserved": "2025-11-03T20:44:48.137Z",
"dateUpdated": "2026-08-13T13:43:04.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0302 (GCVE-0-2026-0302)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:05 – Updated: 2026-09-10 13:00
VLAI
EPSS
VEX
Title
Checkov by Prisma Cloud: OS Command Injection Vulnerability
Summary
An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0302 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Checkov by Prisma Cloud |
Affected:
3.2.0 , < 3.2.502
(custom)
cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:00:38.190667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:00:46.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Checkov by Prisma Cloud",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "3.2.502",
"status": "unaffected"
}
],
"lessThan": "3.2.502",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue.\u0026nbsp;"
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.502",
"versionStartIncluding": "3.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Gherasim"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn OS command injection vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud enables a local user to execute arbitrary commands in the processes running Checkov.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud enables a local user to execute arbitrary commands in the processes running Checkov."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\u0026nbsp;"
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 1.1,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "If the user is able to influence input consumed by a Checkov scan."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:05:20.011Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0302"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eCheckov by Prisma Cloud 3.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e3.2.0 through\u0026nbsp;3.2.501\u003c/td\u003e\n \u003ctd\u003eUpgrade to 3.2.502 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "Version\nMinor Version\nSuggested Solution\n\n Checkov by Prisma Cloud 3.2\n\n 3.2.0 through\u00a03.2.501\n Upgrade to 3.2.502 or later."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Checkov by Prisma Cloud: OS Command Injection Vulnerability",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"Checkov by Prisma Cloud 3.2.0",
"Checkov by Prisma Cloud 3.2.1",
"Checkov by Prisma Cloud 3.2.2",
"Checkov by Prisma Cloud 3.2.3",
"Checkov by Prisma Cloud 3.2.4",
"Checkov by Prisma Cloud 3.2.5",
"Checkov by Prisma Cloud 3.2.6",
"Checkov by Prisma Cloud 3.2.7",
"Checkov by Prisma Cloud 3.2.8",
"Checkov by Prisma Cloud 3.2.9",
"Checkov by Prisma Cloud 3.2.10",
"Checkov by Prisma Cloud 3.2.11",
"Checkov by Prisma Cloud 3.2.12",
"Checkov by Prisma Cloud 3.2.13",
"Checkov by Prisma Cloud 3.2.14",
"Checkov by Prisma Cloud 3.2.15",
"Checkov by Prisma Cloud 3.2.16",
"Checkov by Prisma Cloud 3.2.17",
"Checkov by Prisma Cloud 3.2.18",
"Checkov by Prisma Cloud 3.2.19",
"Checkov by Prisma Cloud 3.2.20",
"Checkov by Prisma Cloud 3.2.21",
"Checkov by Prisma Cloud 3.2.22",
"Checkov by Prisma Cloud 3.2.23",
"Checkov by Prisma Cloud 3.2.24",
"Checkov by Prisma Cloud 3.2.25",
"Checkov by Prisma Cloud 3.2.26",
"Checkov by Prisma Cloud 3.2.27",
"Checkov by Prisma Cloud 3.2.28",
"Checkov by Prisma Cloud 3.2.29",
"Checkov by Prisma Cloud 3.2.30",
"Checkov by Prisma Cloud 3.2.31",
"Checkov by Prisma Cloud 3.2.32",
"Checkov by Prisma Cloud 3.2.33",
"Checkov by Prisma Cloud 3.2.34",
"Checkov by Prisma Cloud 3.2.35",
"Checkov by Prisma Cloud 3.2.36",
"Checkov by Prisma Cloud 3.2.37",
"Checkov by Prisma Cloud 3.2.38",
"Checkov by Prisma Cloud 3.2.39",
"Checkov by Prisma Cloud 3.2.40",
"Checkov by Prisma Cloud 3.2.41",
"Checkov by Prisma Cloud 3.2.42",
"Checkov by Prisma Cloud 3.2.43",
"Checkov by Prisma Cloud 3.2.44",
"Checkov by Prisma Cloud 3.2.45",
"Checkov by Prisma Cloud 3.2.46",
"Checkov by Prisma Cloud 3.2.47",
"Checkov by Prisma Cloud 3.2.48",
"Checkov by Prisma Cloud 3.2.49",
"Checkov by Prisma Cloud 3.2.50",
"Checkov by Prisma Cloud 3.2.51",
"Checkov by Prisma Cloud 3.2.52",
"Checkov by Prisma Cloud 3.2.53",
"Checkov by Prisma Cloud 3.2.54",
"Checkov by Prisma Cloud 3.2.55",
"Checkov by Prisma Cloud 3.2.56",
"Checkov by Prisma Cloud 3.2.57",
"Checkov by Prisma Cloud 3.2.58",
"Checkov by Prisma Cloud 3.2.59",
"Checkov by Prisma Cloud 3.2.60",
"Checkov by Prisma Cloud 3.2.61",
"Checkov by Prisma Cloud 3.2.62",
"Checkov by Prisma Cloud 3.2.63",
"Checkov by Prisma Cloud 3.2.64",
"Checkov by Prisma Cloud 3.2.65",
"Checkov by Prisma Cloud 3.2.66",
"Checkov by Prisma Cloud 3.2.67",
"Checkov by Prisma Cloud 3.2.68",
"Checkov by Prisma Cloud 3.2.69",
"Checkov by Prisma Cloud 3.2.70",
"Checkov by Prisma Cloud 3.2.71",
"Checkov by Prisma Cloud 3.2.72",
"Checkov by Prisma Cloud 3.2.73",
"Checkov by Prisma Cloud 3.2.74",
"Checkov by Prisma Cloud 3.2.75",
"Checkov by Prisma Cloud 3.2.76",
"Checkov by Prisma Cloud 3.2.77",
"Checkov by Prisma Cloud 3.2.78",
"Checkov by Prisma Cloud 3.2.79",
"Checkov by Prisma Cloud 3.2.80",
"Checkov by Prisma Cloud 3.2.81",
"Checkov by Prisma Cloud 3.2.82",
"Checkov by Prisma Cloud 3.2.83",
"Checkov by Prisma Cloud 3.2.84",
"Checkov by Prisma Cloud 3.2.85",
"Checkov by Prisma Cloud 3.2.86",
"Checkov by Prisma Cloud 3.2.87",
"Checkov by Prisma Cloud 3.2.88",
"Checkov by Prisma Cloud 3.2.89",
"Checkov by Prisma Cloud 3.2.90",
"Checkov by Prisma Cloud 3.2.91",
"Checkov by Prisma Cloud 3.2.92",
"Checkov by Prisma Cloud 3.2.93",
"Checkov by Prisma Cloud 3.2.94",
"Checkov by Prisma Cloud 3.2.95",
"Checkov by Prisma Cloud 3.2.96",
"Checkov by Prisma Cloud 3.2.97",
"Checkov by Prisma Cloud 3.2.98",
"Checkov by Prisma Cloud 3.2.99",
"Checkov by Prisma Cloud 3.2.100",
"Checkov by Prisma Cloud 3.2.101",
"Checkov by Prisma Cloud 3.2.102",
"Checkov by Prisma Cloud 3.2.103",
"Checkov by Prisma Cloud 3.2.104",
"Checkov by Prisma Cloud 3.2.105",
"Checkov by Prisma Cloud 3.2.106",
"Checkov by Prisma Cloud 3.2.107",
"Checkov by Prisma Cloud 3.2.108",
"Checkov by Prisma Cloud 3.2.109",
"Checkov by Prisma Cloud 3.2.110",
"Checkov by Prisma Cloud 3.2.111",
"Checkov by Prisma Cloud 3.2.112",
"Checkov by Prisma Cloud 3.2.113",
"Checkov by Prisma Cloud 3.2.114",
"Checkov by Prisma Cloud 3.2.115",
"Checkov by Prisma Cloud 3.2.116",
"Checkov by Prisma Cloud 3.2.117",
"Checkov by Prisma Cloud 3.2.118",
"Checkov by Prisma Cloud 3.2.119",
"Checkov by Prisma Cloud 3.2.120",
"Checkov by Prisma Cloud 3.2.121",
"Checkov by Prisma Cloud 3.2.122",
"Checkov by Prisma Cloud 3.2.123",
"Checkov by Prisma Cloud 3.2.124",
"Checkov by Prisma Cloud 3.2.125",
"Checkov by Prisma Cloud 3.2.126",
"Checkov by Prisma Cloud 3.2.127",
"Checkov by Prisma Cloud 3.2.128",
"Checkov by Prisma Cloud 3.2.129",
"Checkov by Prisma Cloud 3.2.130",
"Checkov by Prisma Cloud 3.2.131",
"Checkov by Prisma Cloud 3.2.132",
"Checkov by Prisma Cloud 3.2.133",
"Checkov by Prisma Cloud 3.2.134",
"Checkov by Prisma Cloud 3.2.135",
"Checkov by Prisma Cloud 3.2.136",
"Checkov by Prisma Cloud 3.2.137",
"Checkov by Prisma Cloud 3.2.138",
"Checkov by Prisma Cloud 3.2.139",
"Checkov by Prisma Cloud 3.2.140",
"Checkov by Prisma Cloud 3.2.141",
"Checkov by Prisma Cloud 3.2.142",
"Checkov by Prisma Cloud 3.2.143",
"Checkov by Prisma Cloud 3.2.144",
"Checkov by Prisma Cloud 3.2.145",
"Checkov by Prisma Cloud 3.2.146",
"Checkov by Prisma Cloud 3.2.147",
"Checkov by Prisma Cloud 3.2.148",
"Checkov by Prisma Cloud 3.2.149",
"Checkov by Prisma Cloud 3.2.150",
"Checkov by Prisma Cloud 3.2.151",
"Checkov by Prisma Cloud 3.2.152",
"Checkov by Prisma Cloud 3.2.153",
"Checkov by Prisma Cloud 3.2.154",
"Checkov by Prisma Cloud 3.2.155",
"Checkov by Prisma Cloud 3.2.156",
"Checkov by Prisma Cloud 3.2.157",
"Checkov by Prisma Cloud 3.2.158",
"Checkov by Prisma Cloud 3.2.159",
"Checkov by Prisma Cloud 3.2.160",
"Checkov by Prisma Cloud 3.2.161",
"Checkov by Prisma Cloud 3.2.162",
"Checkov by Prisma Cloud 3.2.163",
"Checkov by Prisma Cloud 3.2.164",
"Checkov by Prisma Cloud 3.2.165",
"Checkov by Prisma Cloud 3.2.166",
"Checkov by Prisma Cloud 3.2.167",
"Checkov by Prisma Cloud 3.2.168",
"Checkov by Prisma Cloud 3.2.169",
"Checkov by Prisma Cloud 3.2.170",
"Checkov by Prisma Cloud 3.2.171",
"Checkov by Prisma Cloud 3.2.172",
"Checkov by Prisma Cloud 3.2.173",
"Checkov by Prisma Cloud 3.2.174",
"Checkov by Prisma Cloud 3.2.175",
"Checkov by Prisma Cloud 3.2.176",
"Checkov by Prisma Cloud 3.2.177",
"Checkov by Prisma Cloud 3.2.178",
"Checkov by Prisma Cloud 3.2.179",
"Checkov by Prisma Cloud 3.2.180",
"Checkov by Prisma Cloud 3.2.181",
"Checkov by Prisma Cloud 3.2.182",
"Checkov by Prisma Cloud 3.2.183",
"Checkov by Prisma Cloud 3.2.184",
"Checkov by Prisma Cloud 3.2.185",
"Checkov by Prisma Cloud 3.2.186",
"Checkov by Prisma Cloud 3.2.187",
"Checkov by Prisma Cloud 3.2.188",
"Checkov by Prisma Cloud 3.2.189",
"Checkov by Prisma Cloud 3.2.190",
"Checkov by Prisma Cloud 3.2.191",
"Checkov by Prisma Cloud 3.2.192",
"Checkov by Prisma Cloud 3.2.193",
"Checkov by Prisma Cloud 3.2.194",
"Checkov by Prisma Cloud 3.2.195",
"Checkov by Prisma Cloud 3.2.196",
"Checkov by Prisma Cloud 3.2.197",
"Checkov by Prisma Cloud 3.2.198",
"Checkov by Prisma Cloud 3.2.199",
"Checkov by Prisma Cloud 3.2.200",
"Checkov by Prisma Cloud 3.2.201",
"Checkov by Prisma Cloud 3.2.202",
"Checkov by Prisma Cloud 3.2.203",
"Checkov by Prisma Cloud 3.2.204",
"Checkov by Prisma Cloud 3.2.205",
"Checkov by Prisma Cloud 3.2.206",
"Checkov by Prisma Cloud 3.2.207",
"Checkov by Prisma Cloud 3.2.208",
"Checkov by Prisma Cloud 3.2.209",
"Checkov by Prisma Cloud 3.2.210",
"Checkov by Prisma Cloud 3.2.211",
"Checkov by Prisma Cloud 3.2.212",
"Checkov by Prisma Cloud 3.2.213",
"Checkov by Prisma Cloud 3.2.214",
"Checkov by Prisma Cloud 3.2.215",
"Checkov by Prisma Cloud 3.2.216",
"Checkov by Prisma Cloud 3.2.217",
"Checkov by Prisma Cloud 3.2.218",
"Checkov by Prisma Cloud 3.2.219",
"Checkov by Prisma Cloud 3.2.220",
"Checkov by Prisma Cloud 3.2.221",
"Checkov by Prisma Cloud 3.2.222",
"Checkov by Prisma Cloud 3.2.223",
"Checkov by Prisma Cloud 3.2.224",
"Checkov by Prisma Cloud 3.2.225",
"Checkov by Prisma Cloud 3.2.226",
"Checkov by Prisma Cloud 3.2.227",
"Checkov by Prisma Cloud 3.2.228",
"Checkov by Prisma Cloud 3.2.229",
"Checkov by Prisma Cloud 3.2.230",
"Checkov by Prisma Cloud 3.2.231",
"Checkov by Prisma Cloud 3.2.232",
"Checkov by Prisma Cloud 3.2.233",
"Checkov by Prisma Cloud 3.2.234",
"Checkov by Prisma Cloud 3.2.235",
"Checkov by Prisma Cloud 3.2.236",
"Checkov by Prisma Cloud 3.2.237",
"Checkov by Prisma Cloud 3.2.238",
"Checkov by Prisma Cloud 3.2.239",
"Checkov by Prisma Cloud 3.2.240",
"Checkov by Prisma Cloud 3.2.241",
"Checkov by Prisma Cloud 3.2.242",
"Checkov by Prisma Cloud 3.2.243",
"Checkov by Prisma Cloud 3.2.244",
"Checkov by Prisma Cloud 3.2.245",
"Checkov by Prisma Cloud 3.2.246",
"Checkov by Prisma Cloud 3.2.247",
"Checkov by Prisma Cloud 3.2.248",
"Checkov by Prisma Cloud 3.2.249",
"Checkov by Prisma Cloud 3.2.250",
"Checkov by Prisma Cloud 3.2.251",
"Checkov by Prisma Cloud 3.2.252",
"Checkov by Prisma Cloud 3.2.253",
"Checkov by Prisma Cloud 3.2.254",
"Checkov by Prisma Cloud 3.2.255",
"Checkov by Prisma Cloud 3.2.256",
"Checkov by Prisma Cloud 3.2.257",
"Checkov by Prisma Cloud 3.2.258",
"Checkov by Prisma Cloud 3.2.259",
"Checkov by Prisma Cloud 3.2.260",
"Checkov by Prisma Cloud 3.2.261",
"Checkov by Prisma Cloud 3.2.262",
"Checkov by Prisma Cloud 3.2.263",
"Checkov by Prisma Cloud 3.2.264",
"Checkov by Prisma Cloud 3.2.265",
"Checkov by Prisma Cloud 3.2.266",
"Checkov by Prisma Cloud 3.2.267",
"Checkov by Prisma Cloud 3.2.268",
"Checkov by Prisma Cloud 3.2.269",
"Checkov by Prisma Cloud 3.2.270",
"Checkov by Prisma Cloud 3.2.271",
"Checkov by Prisma Cloud 3.2.272",
"Checkov by Prisma Cloud 3.2.273",
"Checkov by Prisma Cloud 3.2.274",
"Checkov by Prisma Cloud 3.2.275",
"Checkov by Prisma Cloud 3.2.276",
"Checkov by Prisma Cloud 3.2.277",
"Checkov by Prisma Cloud 3.2.278",
"Checkov by Prisma Cloud 3.2.279",
"Checkov by Prisma Cloud 3.2.280",
"Checkov by Prisma Cloud 3.2.281",
"Checkov by Prisma Cloud 3.2.282",
"Checkov by Prisma Cloud 3.2.283",
"Checkov by Prisma Cloud 3.2.284",
"Checkov by Prisma Cloud 3.2.285",
"Checkov by Prisma Cloud 3.2.286",
"Checkov by Prisma Cloud 3.2.287",
"Checkov by Prisma Cloud 3.2.288",
"Checkov by Prisma Cloud 3.2.289",
"Checkov by Prisma Cloud 3.2.290",
"Checkov by Prisma Cloud 3.2.291",
"Checkov by Prisma Cloud 3.2.292",
"Checkov by Prisma Cloud 3.2.293",
"Checkov by Prisma Cloud 3.2.294",
"Checkov by Prisma Cloud 3.2.295",
"Checkov by Prisma Cloud 3.2.296",
"Checkov by Prisma Cloud 3.2.297",
"Checkov by Prisma Cloud 3.2.298",
"Checkov by Prisma Cloud 3.2.299",
"Checkov by Prisma Cloud 3.2.300",
"Checkov by Prisma Cloud 3.2.301",
"Checkov by Prisma Cloud 3.2.302",
"Checkov by Prisma Cloud 3.2.303",
"Checkov by Prisma Cloud 3.2.304",
"Checkov by Prisma Cloud 3.2.305",
"Checkov by Prisma Cloud 3.2.306",
"Checkov by Prisma Cloud 3.2.307",
"Checkov by Prisma Cloud 3.2.308",
"Checkov by Prisma Cloud 3.2.309",
"Checkov by Prisma Cloud 3.2.310",
"Checkov by Prisma Cloud 3.2.311",
"Checkov by Prisma Cloud 3.2.312",
"Checkov by Prisma Cloud 3.2.313",
"Checkov by Prisma Cloud 3.2.314",
"Checkov by Prisma Cloud 3.2.315",
"Checkov by Prisma Cloud 3.2.316",
"Checkov by Prisma Cloud 3.2.317",
"Checkov by Prisma Cloud 3.2.318",
"Checkov by Prisma Cloud 3.2.319",
"Checkov by Prisma Cloud 3.2.320",
"Checkov by Prisma Cloud 3.2.321",
"Checkov by Prisma Cloud 3.2.322",
"Checkov by Prisma Cloud 3.2.323",
"Checkov by Prisma Cloud 3.2.324",
"Checkov by Prisma Cloud 3.2.325",
"Checkov by Prisma Cloud 3.2.326",
"Checkov by Prisma Cloud 3.2.327",
"Checkov by Prisma Cloud 3.2.328",
"Checkov by Prisma Cloud 3.2.329",
"Checkov by Prisma Cloud 3.2.330",
"Checkov by Prisma Cloud 3.2.331",
"Checkov by Prisma Cloud 3.2.332",
"Checkov by Prisma Cloud 3.2.333",
"Checkov by Prisma Cloud 3.2.334",
"Checkov by Prisma Cloud 3.2.335",
"Checkov by Prisma Cloud 3.2.336",
"Checkov by Prisma Cloud 3.2.337",
"Checkov by Prisma Cloud 3.2.338",
"Checkov by Prisma Cloud 3.2.339",
"Checkov by Prisma Cloud 3.2.340",
"Checkov by Prisma Cloud 3.2.341",
"Checkov by Prisma Cloud 3.2.342",
"Checkov by Prisma Cloud 3.2.343",
"Checkov by Prisma Cloud 3.2.344",
"Checkov by Prisma Cloud 3.2.345",
"Checkov by Prisma Cloud 3.2.346",
"Checkov by Prisma Cloud 3.2.347",
"Checkov by Prisma Cloud 3.2.348",
"Checkov by Prisma Cloud 3.2.349",
"Checkov by Prisma Cloud 3.2.350",
"Checkov by Prisma Cloud 3.2.351",
"Checkov by Prisma Cloud 3.2.352",
"Checkov by Prisma Cloud 3.2.353",
"Checkov by Prisma Cloud 3.2.354",
"Checkov by Prisma Cloud 3.2.355",
"Checkov by Prisma Cloud 3.2.356",
"Checkov by Prisma Cloud 3.2.357",
"Checkov by Prisma Cloud 3.2.358",
"Checkov by Prisma Cloud 3.2.359",
"Checkov by Prisma Cloud 3.2.360",
"Checkov by Prisma Cloud 3.2.361",
"Checkov by Prisma Cloud 3.2.362",
"Checkov by Prisma Cloud 3.2.363",
"Checkov by Prisma Cloud 3.2.364",
"Checkov by Prisma Cloud 3.2.365",
"Checkov by Prisma Cloud 3.2.366",
"Checkov by Prisma Cloud 3.2.367",
"Checkov by Prisma Cloud 3.2.368",
"Checkov by Prisma Cloud 3.2.369",
"Checkov by Prisma Cloud 3.2.370",
"Checkov by Prisma Cloud 3.2.371",
"Checkov by Prisma Cloud 3.2.372",
"Checkov by Prisma Cloud 3.2.373",
"Checkov by Prisma Cloud 3.2.374",
"Checkov by Prisma Cloud 3.2.375",
"Checkov by Prisma Cloud 3.2.376",
"Checkov by Prisma Cloud 3.2.377",
"Checkov by Prisma Cloud 3.2.378",
"Checkov by Prisma Cloud 3.2.379",
"Checkov by Prisma Cloud 3.2.380",
"Checkov by Prisma Cloud 3.2.381",
"Checkov by Prisma Cloud 3.2.382",
"Checkov by Prisma Cloud 3.2.383",
"Checkov by Prisma Cloud 3.2.384",
"Checkov by Prisma Cloud 3.2.385",
"Checkov by Prisma Cloud 3.2.386",
"Checkov by Prisma Cloud 3.2.387",
"Checkov by Prisma Cloud 3.2.388",
"Checkov by Prisma Cloud 3.2.389",
"Checkov by Prisma Cloud 3.2.390",
"Checkov by Prisma Cloud 3.2.391",
"Checkov by Prisma Cloud 3.2.392",
"Checkov by Prisma Cloud 3.2.393",
"Checkov by Prisma Cloud 3.2.394",
"Checkov by Prisma Cloud 3.2.395",
"Checkov by Prisma Cloud 3.2.396",
"Checkov by Prisma Cloud 3.2.397",
"Checkov by Prisma Cloud 3.2.398",
"Checkov by Prisma Cloud 3.2.399",
"Checkov by Prisma Cloud 3.2.400",
"Checkov by Prisma Cloud 3.2.401",
"Checkov by Prisma Cloud 3.2.402",
"Checkov by Prisma Cloud 3.2.403",
"Checkov by Prisma Cloud 3.2.404",
"Checkov by Prisma Cloud 3.2.405",
"Checkov by Prisma Cloud 3.2.406",
"Checkov by Prisma Cloud 3.2.407",
"Checkov by Prisma Cloud 3.2.408",
"Checkov by Prisma Cloud 3.2.409",
"Checkov by Prisma Cloud 3.2.410",
"Checkov by Prisma Cloud 3.2.411",
"Checkov by Prisma Cloud 3.2.412",
"Checkov by Prisma Cloud 3.2.413",
"Checkov by Prisma Cloud 3.2.414",
"Checkov by Prisma Cloud 3.2.415",
"Checkov by Prisma Cloud 3.2.416",
"Checkov by Prisma Cloud 3.2.417",
"Checkov by Prisma Cloud 3.2.418",
"Checkov by Prisma Cloud 3.2.419",
"Checkov by Prisma Cloud 3.2.420",
"Checkov by Prisma Cloud 3.2.421",
"Checkov by Prisma Cloud 3.2.422",
"Checkov by Prisma Cloud 3.2.423",
"Checkov by Prisma Cloud 3.2.424",
"Checkov by Prisma Cloud 3.2.425",
"Checkov by Prisma Cloud 3.2.426",
"Checkov by Prisma Cloud 3.2.427",
"Checkov by Prisma Cloud 3.2.428",
"Checkov by Prisma Cloud 3.2.429",
"Checkov by Prisma Cloud 3.2.430",
"Checkov by Prisma Cloud 3.2.431",
"Checkov by Prisma Cloud 3.2.432",
"Checkov by Prisma Cloud 3.2.433",
"Checkov by Prisma Cloud 3.2.434",
"Checkov by Prisma Cloud 3.2.435",
"Checkov by Prisma Cloud 3.2.436",
"Checkov by Prisma Cloud 3.2.437",
"Checkov by Prisma Cloud 3.2.438",
"Checkov by Prisma Cloud 3.2.439",
"Checkov by Prisma Cloud 3.2.440",
"Checkov by Prisma Cloud 3.2.441",
"Checkov by Prisma Cloud 3.2.442",
"Checkov by Prisma Cloud 3.2.443",
"Checkov by Prisma Cloud 3.2.444",
"Checkov by Prisma Cloud 3.2.445",
"Checkov by Prisma Cloud 3.2.446",
"Checkov by Prisma Cloud 3.2.447",
"Checkov by Prisma Cloud 3.2.448",
"Checkov by Prisma Cloud 3.2.449",
"Checkov by Prisma Cloud 3.2.450",
"Checkov by Prisma Cloud 3.2.451",
"Checkov by Prisma Cloud 3.2.452",
"Checkov by Prisma Cloud 3.2.453",
"Checkov by Prisma Cloud 3.2.454",
"Checkov by Prisma Cloud 3.2.455",
"Checkov by Prisma Cloud 3.2.456",
"Checkov by Prisma Cloud 3.2.457",
"Checkov by Prisma Cloud 3.2.458",
"Checkov by Prisma Cloud 3.2.459",
"Checkov by Prisma Cloud 3.2.460",
"Checkov by Prisma Cloud 3.2.461",
"Checkov by Prisma Cloud 3.2.462",
"Checkov by Prisma Cloud 3.2.463",
"Checkov by Prisma Cloud 3.2.464",
"Checkov by Prisma Cloud 3.2.465",
"Checkov by Prisma Cloud 3.2.466",
"Checkov by Prisma Cloud 3.2.467",
"Checkov by Prisma Cloud 3.2.468",
"Checkov by Prisma Cloud 3.2.469",
"Checkov by Prisma Cloud 3.2.470",
"Checkov by Prisma Cloud 3.2.471",
"Checkov by Prisma Cloud 3.2.472",
"Checkov by Prisma Cloud 3.2.473",
"Checkov by Prisma Cloud 3.2.474",
"Checkov by Prisma Cloud 3.2.475",
"Checkov by Prisma Cloud 3.2.476",
"Checkov by Prisma Cloud 3.2.477",
"Checkov by Prisma Cloud 3.2.478",
"Checkov by Prisma Cloud 3.2.479",
"Checkov by Prisma Cloud 3.2.480",
"Checkov by Prisma Cloud 3.2.481",
"Checkov by Prisma Cloud 3.2.482",
"Checkov by Prisma Cloud 3.2.483",
"Checkov by Prisma Cloud 3.2.484",
"Checkov by Prisma Cloud 3.2.485",
"Checkov by Prisma Cloud 3.2.486",
"Checkov by Prisma Cloud 3.2.487",
"Checkov by Prisma Cloud 3.2.488",
"Checkov by Prisma Cloud 3.2.489",
"Checkov by Prisma Cloud 3.2.490",
"Checkov by Prisma Cloud 3.2.491",
"Checkov by Prisma Cloud 3.2.492",
"Checkov by Prisma Cloud 3.2.493",
"Checkov by Prisma Cloud 3.2.494",
"Checkov by Prisma Cloud 3.2.495",
"Checkov by Prisma Cloud 3.2.496",
"Checkov by Prisma Cloud 3.2.497",
"Checkov by Prisma Cloud 3.2.498",
"Checkov by Prisma Cloud 3.2.499",
"Checkov by Prisma Cloud 3.2.500",
"Checkov by Prisma Cloud 3.2.501"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0302",
"datePublished": "2026-09-10T06:05:20.011Z",
"dateReserved": "2025-11-03T20:45:00.329Z",
"dateUpdated": "2026-09-10T13:00:46.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0303 (GCVE-0-2026-0303)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:03 – Updated: 2026-09-10 13:01
VLAI
EPSS
VEX
Title
Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File
Summary
A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:01 UTC
CWE
- CWE-829 - Inclusion of Functionality from Untrusted Control Sphere
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0303 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Checkov by Prisma Cloud |
Affected:
3.2.0 , < 3.2.532
(custom)
cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0303",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:01:15.631812Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:01:27.361Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Checkov by Prisma Cloud",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "3.2.532",
"status": "unaffected"
}
],
"lessThan": "3.2.532",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eNo special configuration is required to be vulnerable to this issue.\u003c/span\u003e"
}
],
"value": "No special configuration is required to be vulnerable to this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:checkov_by_prisma_cloud:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.532",
"versionStartIncluding": "3.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Adedeji"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA code execution vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.\u0026nbsp;\u003c/p\u003e"
}
],
"value": "A code execution vulnerability in Palo Alto Networks Checkov by Prisma\u00ae Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue.\u0026nbsp;"
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-248",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-248 Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 2.4,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "If the user scans infrastructure as code (IaC) files from untrusted sources."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:03:50.513Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0303"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eCheckov by Prisma Cloud 3.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e3.2.0 through 3.2.531\u003c/td\u003e\n \u003ctd\u003eUpgrade to 3.2.532or later.\u003c/td\u003e\n \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cbr\u003eCheckov integration in Prisma Cloud is upgraded automatically when new versions become available."
}
],
"value": "Version\nMinor Version\nSuggested Solution\n\n Checkov by Prisma Cloud 3.2\n\n 3.2.0 through 3.2.531\n Upgrade to 3.2.532or later.\n \nCheckov integration in Prisma Cloud is upgraded automatically when new versions become available."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory."
}
],
"value": "Until a fixed version is deployed, avoid running Checkov over untrusted content, and pass configuration explicitly via a trusted configuration file rather than allowing configuration to be auto-loaded from the scanned directory."
}
],
"x_affectedList": [
"Checkov by Prisma Cloud 3.2.0",
"Checkov by Prisma Cloud 3.2.1",
"Checkov by Prisma Cloud 3.2.2",
"Checkov by Prisma Cloud 3.2.3",
"Checkov by Prisma Cloud 3.2.4",
"Checkov by Prisma Cloud 3.2.5",
"Checkov by Prisma Cloud 3.2.6",
"Checkov by Prisma Cloud 3.2.7",
"Checkov by Prisma Cloud 3.2.8",
"Checkov by Prisma Cloud 3.2.9",
"Checkov by Prisma Cloud 3.2.10",
"Checkov by Prisma Cloud 3.2.11",
"Checkov by Prisma Cloud 3.2.12",
"Checkov by Prisma Cloud 3.2.13",
"Checkov by Prisma Cloud 3.2.14",
"Checkov by Prisma Cloud 3.2.15",
"Checkov by Prisma Cloud 3.2.16",
"Checkov by Prisma Cloud 3.2.17",
"Checkov by Prisma Cloud 3.2.18",
"Checkov by Prisma Cloud 3.2.19",
"Checkov by Prisma Cloud 3.2.20",
"Checkov by Prisma Cloud 3.2.21",
"Checkov by Prisma Cloud 3.2.22",
"Checkov by Prisma Cloud 3.2.23",
"Checkov by Prisma Cloud 3.2.24",
"Checkov by Prisma Cloud 3.2.25",
"Checkov by Prisma Cloud 3.2.26",
"Checkov by Prisma Cloud 3.2.27",
"Checkov by Prisma Cloud 3.2.28",
"Checkov by Prisma Cloud 3.2.29",
"Checkov by Prisma Cloud 3.2.30",
"Checkov by Prisma Cloud 3.2.31",
"Checkov by Prisma Cloud 3.2.32",
"Checkov by Prisma Cloud 3.2.33",
"Checkov by Prisma Cloud 3.2.34",
"Checkov by Prisma Cloud 3.2.35",
"Checkov by Prisma Cloud 3.2.36",
"Checkov by Prisma Cloud 3.2.37",
"Checkov by Prisma Cloud 3.2.38",
"Checkov by Prisma Cloud 3.2.39",
"Checkov by Prisma Cloud 3.2.40",
"Checkov by Prisma Cloud 3.2.41",
"Checkov by Prisma Cloud 3.2.42",
"Checkov by Prisma Cloud 3.2.43",
"Checkov by Prisma Cloud 3.2.44",
"Checkov by Prisma Cloud 3.2.45",
"Checkov by Prisma Cloud 3.2.46",
"Checkov by Prisma Cloud 3.2.47",
"Checkov by Prisma Cloud 3.2.48",
"Checkov by Prisma Cloud 3.2.49",
"Checkov by Prisma Cloud 3.2.50",
"Checkov by Prisma Cloud 3.2.51",
"Checkov by Prisma Cloud 3.2.52",
"Checkov by Prisma Cloud 3.2.53",
"Checkov by Prisma Cloud 3.2.54",
"Checkov by Prisma Cloud 3.2.55",
"Checkov by Prisma Cloud 3.2.56",
"Checkov by Prisma Cloud 3.2.57",
"Checkov by Prisma Cloud 3.2.58",
"Checkov by Prisma Cloud 3.2.59",
"Checkov by Prisma Cloud 3.2.60",
"Checkov by Prisma Cloud 3.2.61",
"Checkov by Prisma Cloud 3.2.62",
"Checkov by Prisma Cloud 3.2.63",
"Checkov by Prisma Cloud 3.2.64",
"Checkov by Prisma Cloud 3.2.65",
"Checkov by Prisma Cloud 3.2.66",
"Checkov by Prisma Cloud 3.2.67",
"Checkov by Prisma Cloud 3.2.68",
"Checkov by Prisma Cloud 3.2.69",
"Checkov by Prisma Cloud 3.2.70",
"Checkov by Prisma Cloud 3.2.71",
"Checkov by Prisma Cloud 3.2.72",
"Checkov by Prisma Cloud 3.2.73",
"Checkov by Prisma Cloud 3.2.74",
"Checkov by Prisma Cloud 3.2.75",
"Checkov by Prisma Cloud 3.2.76",
"Checkov by Prisma Cloud 3.2.77",
"Checkov by Prisma Cloud 3.2.78",
"Checkov by Prisma Cloud 3.2.79",
"Checkov by Prisma Cloud 3.2.80",
"Checkov by Prisma Cloud 3.2.81",
"Checkov by Prisma Cloud 3.2.82",
"Checkov by Prisma Cloud 3.2.83",
"Checkov by Prisma Cloud 3.2.84",
"Checkov by Prisma Cloud 3.2.85",
"Checkov by Prisma Cloud 3.2.86",
"Checkov by Prisma Cloud 3.2.87",
"Checkov by Prisma Cloud 3.2.88",
"Checkov by Prisma Cloud 3.2.89",
"Checkov by Prisma Cloud 3.2.90",
"Checkov by Prisma Cloud 3.2.91",
"Checkov by Prisma Cloud 3.2.92",
"Checkov by Prisma Cloud 3.2.93",
"Checkov by Prisma Cloud 3.2.94",
"Checkov by Prisma Cloud 3.2.95",
"Checkov by Prisma Cloud 3.2.96",
"Checkov by Prisma Cloud 3.2.97",
"Checkov by Prisma Cloud 3.2.98",
"Checkov by Prisma Cloud 3.2.99",
"Checkov by Prisma Cloud 3.2.100",
"Checkov by Prisma Cloud 3.2.101",
"Checkov by Prisma Cloud 3.2.102",
"Checkov by Prisma Cloud 3.2.103",
"Checkov by Prisma Cloud 3.2.104",
"Checkov by Prisma Cloud 3.2.105",
"Checkov by Prisma Cloud 3.2.106",
"Checkov by Prisma Cloud 3.2.107",
"Checkov by Prisma Cloud 3.2.108",
"Checkov by Prisma Cloud 3.2.109",
"Checkov by Prisma Cloud 3.2.110",
"Checkov by Prisma Cloud 3.2.111",
"Checkov by Prisma Cloud 3.2.112",
"Checkov by Prisma Cloud 3.2.113",
"Checkov by Prisma Cloud 3.2.114",
"Checkov by Prisma Cloud 3.2.115",
"Checkov by Prisma Cloud 3.2.116",
"Checkov by Prisma Cloud 3.2.117",
"Checkov by Prisma Cloud 3.2.118",
"Checkov by Prisma Cloud 3.2.119",
"Checkov by Prisma Cloud 3.2.120",
"Checkov by Prisma Cloud 3.2.121",
"Checkov by Prisma Cloud 3.2.122",
"Checkov by Prisma Cloud 3.2.123",
"Checkov by Prisma Cloud 3.2.124",
"Checkov by Prisma Cloud 3.2.125",
"Checkov by Prisma Cloud 3.2.126",
"Checkov by Prisma Cloud 3.2.127",
"Checkov by Prisma Cloud 3.2.128",
"Checkov by Prisma Cloud 3.2.129",
"Checkov by Prisma Cloud 3.2.130",
"Checkov by Prisma Cloud 3.2.131",
"Checkov by Prisma Cloud 3.2.132",
"Checkov by Prisma Cloud 3.2.133",
"Checkov by Prisma Cloud 3.2.134",
"Checkov by Prisma Cloud 3.2.135",
"Checkov by Prisma Cloud 3.2.136",
"Checkov by Prisma Cloud 3.2.137",
"Checkov by Prisma Cloud 3.2.138",
"Checkov by Prisma Cloud 3.2.139",
"Checkov by Prisma Cloud 3.2.140",
"Checkov by Prisma Cloud 3.2.141",
"Checkov by Prisma Cloud 3.2.142",
"Checkov by Prisma Cloud 3.2.143",
"Checkov by Prisma Cloud 3.2.144",
"Checkov by Prisma Cloud 3.2.145",
"Checkov by Prisma Cloud 3.2.146",
"Checkov by Prisma Cloud 3.2.147",
"Checkov by Prisma Cloud 3.2.148",
"Checkov by Prisma Cloud 3.2.149",
"Checkov by Prisma Cloud 3.2.150",
"Checkov by Prisma Cloud 3.2.151",
"Checkov by Prisma Cloud 3.2.152",
"Checkov by Prisma Cloud 3.2.153",
"Checkov by Prisma Cloud 3.2.154",
"Checkov by Prisma Cloud 3.2.155",
"Checkov by Prisma Cloud 3.2.156",
"Checkov by Prisma Cloud 3.2.157",
"Checkov by Prisma Cloud 3.2.158",
"Checkov by Prisma Cloud 3.2.159",
"Checkov by Prisma Cloud 3.2.160",
"Checkov by Prisma Cloud 3.2.161",
"Checkov by Prisma Cloud 3.2.162",
"Checkov by Prisma Cloud 3.2.163",
"Checkov by Prisma Cloud 3.2.164",
"Checkov by Prisma Cloud 3.2.165",
"Checkov by Prisma Cloud 3.2.166",
"Checkov by Prisma Cloud 3.2.167",
"Checkov by Prisma Cloud 3.2.168",
"Checkov by Prisma Cloud 3.2.169",
"Checkov by Prisma Cloud 3.2.170",
"Checkov by Prisma Cloud 3.2.171",
"Checkov by Prisma Cloud 3.2.172",
"Checkov by Prisma Cloud 3.2.173",
"Checkov by Prisma Cloud 3.2.174",
"Checkov by Prisma Cloud 3.2.175",
"Checkov by Prisma Cloud 3.2.176",
"Checkov by Prisma Cloud 3.2.177",
"Checkov by Prisma Cloud 3.2.178",
"Checkov by Prisma Cloud 3.2.179",
"Checkov by Prisma Cloud 3.2.180",
"Checkov by Prisma Cloud 3.2.181",
"Checkov by Prisma Cloud 3.2.182",
"Checkov by Prisma Cloud 3.2.183",
"Checkov by Prisma Cloud 3.2.184",
"Checkov by Prisma Cloud 3.2.185",
"Checkov by Prisma Cloud 3.2.186",
"Checkov by Prisma Cloud 3.2.187",
"Checkov by Prisma Cloud 3.2.188",
"Checkov by Prisma Cloud 3.2.189",
"Checkov by Prisma Cloud 3.2.190",
"Checkov by Prisma Cloud 3.2.191",
"Checkov by Prisma Cloud 3.2.192",
"Checkov by Prisma Cloud 3.2.193",
"Checkov by Prisma Cloud 3.2.194",
"Checkov by Prisma Cloud 3.2.195",
"Checkov by Prisma Cloud 3.2.196",
"Checkov by Prisma Cloud 3.2.197",
"Checkov by Prisma Cloud 3.2.198",
"Checkov by Prisma Cloud 3.2.199",
"Checkov by Prisma Cloud 3.2.200",
"Checkov by Prisma Cloud 3.2.201",
"Checkov by Prisma Cloud 3.2.202",
"Checkov by Prisma Cloud 3.2.203",
"Checkov by Prisma Cloud 3.2.204",
"Checkov by Prisma Cloud 3.2.205",
"Checkov by Prisma Cloud 3.2.206",
"Checkov by Prisma Cloud 3.2.207",
"Checkov by Prisma Cloud 3.2.208",
"Checkov by Prisma Cloud 3.2.209",
"Checkov by Prisma Cloud 3.2.210",
"Checkov by Prisma Cloud 3.2.211",
"Checkov by Prisma Cloud 3.2.212",
"Checkov by Prisma Cloud 3.2.213",
"Checkov by Prisma Cloud 3.2.214",
"Checkov by Prisma Cloud 3.2.215",
"Checkov by Prisma Cloud 3.2.216",
"Checkov by Prisma Cloud 3.2.217",
"Checkov by Prisma Cloud 3.2.218",
"Checkov by Prisma Cloud 3.2.219",
"Checkov by Prisma Cloud 3.2.220",
"Checkov by Prisma Cloud 3.2.221",
"Checkov by Prisma Cloud 3.2.222",
"Checkov by Prisma Cloud 3.2.223",
"Checkov by Prisma Cloud 3.2.224",
"Checkov by Prisma Cloud 3.2.225",
"Checkov by Prisma Cloud 3.2.226",
"Checkov by Prisma Cloud 3.2.227",
"Checkov by Prisma Cloud 3.2.228",
"Checkov by Prisma Cloud 3.2.229",
"Checkov by Prisma Cloud 3.2.230",
"Checkov by Prisma Cloud 3.2.231",
"Checkov by Prisma Cloud 3.2.232",
"Checkov by Prisma Cloud 3.2.233",
"Checkov by Prisma Cloud 3.2.234",
"Checkov by Prisma Cloud 3.2.235",
"Checkov by Prisma Cloud 3.2.236",
"Checkov by Prisma Cloud 3.2.237",
"Checkov by Prisma Cloud 3.2.238",
"Checkov by Prisma Cloud 3.2.239",
"Checkov by Prisma Cloud 3.2.240",
"Checkov by Prisma Cloud 3.2.241",
"Checkov by Prisma Cloud 3.2.242",
"Checkov by Prisma Cloud 3.2.243",
"Checkov by Prisma Cloud 3.2.244",
"Checkov by Prisma Cloud 3.2.245",
"Checkov by Prisma Cloud 3.2.246",
"Checkov by Prisma Cloud 3.2.247",
"Checkov by Prisma Cloud 3.2.248",
"Checkov by Prisma Cloud 3.2.249",
"Checkov by Prisma Cloud 3.2.250",
"Checkov by Prisma Cloud 3.2.251",
"Checkov by Prisma Cloud 3.2.252",
"Checkov by Prisma Cloud 3.2.253",
"Checkov by Prisma Cloud 3.2.254",
"Checkov by Prisma Cloud 3.2.255",
"Checkov by Prisma Cloud 3.2.256",
"Checkov by Prisma Cloud 3.2.257",
"Checkov by Prisma Cloud 3.2.258",
"Checkov by Prisma Cloud 3.2.259",
"Checkov by Prisma Cloud 3.2.260",
"Checkov by Prisma Cloud 3.2.261",
"Checkov by Prisma Cloud 3.2.262",
"Checkov by Prisma Cloud 3.2.263",
"Checkov by Prisma Cloud 3.2.264",
"Checkov by Prisma Cloud 3.2.265",
"Checkov by Prisma Cloud 3.2.266",
"Checkov by Prisma Cloud 3.2.267",
"Checkov by Prisma Cloud 3.2.268",
"Checkov by Prisma Cloud 3.2.269",
"Checkov by Prisma Cloud 3.2.270",
"Checkov by Prisma Cloud 3.2.271",
"Checkov by Prisma Cloud 3.2.272",
"Checkov by Prisma Cloud 3.2.273",
"Checkov by Prisma Cloud 3.2.274",
"Checkov by Prisma Cloud 3.2.275",
"Checkov by Prisma Cloud 3.2.276",
"Checkov by Prisma Cloud 3.2.277",
"Checkov by Prisma Cloud 3.2.278",
"Checkov by Prisma Cloud 3.2.279",
"Checkov by Prisma Cloud 3.2.280",
"Checkov by Prisma Cloud 3.2.281",
"Checkov by Prisma Cloud 3.2.282",
"Checkov by Prisma Cloud 3.2.283",
"Checkov by Prisma Cloud 3.2.284",
"Checkov by Prisma Cloud 3.2.285",
"Checkov by Prisma Cloud 3.2.286",
"Checkov by Prisma Cloud 3.2.287",
"Checkov by Prisma Cloud 3.2.288",
"Checkov by Prisma Cloud 3.2.289",
"Checkov by Prisma Cloud 3.2.290",
"Checkov by Prisma Cloud 3.2.291",
"Checkov by Prisma Cloud 3.2.292",
"Checkov by Prisma Cloud 3.2.293",
"Checkov by Prisma Cloud 3.2.294",
"Checkov by Prisma Cloud 3.2.295",
"Checkov by Prisma Cloud 3.2.296",
"Checkov by Prisma Cloud 3.2.297",
"Checkov by Prisma Cloud 3.2.298",
"Checkov by Prisma Cloud 3.2.299",
"Checkov by Prisma Cloud 3.2.300",
"Checkov by Prisma Cloud 3.2.301",
"Checkov by Prisma Cloud 3.2.302",
"Checkov by Prisma Cloud 3.2.303",
"Checkov by Prisma Cloud 3.2.304",
"Checkov by Prisma Cloud 3.2.305",
"Checkov by Prisma Cloud 3.2.306",
"Checkov by Prisma Cloud 3.2.307",
"Checkov by Prisma Cloud 3.2.308",
"Checkov by Prisma Cloud 3.2.309",
"Checkov by Prisma Cloud 3.2.310",
"Checkov by Prisma Cloud 3.2.311",
"Checkov by Prisma Cloud 3.2.312",
"Checkov by Prisma Cloud 3.2.313",
"Checkov by Prisma Cloud 3.2.314",
"Checkov by Prisma Cloud 3.2.315",
"Checkov by Prisma Cloud 3.2.316",
"Checkov by Prisma Cloud 3.2.317",
"Checkov by Prisma Cloud 3.2.318",
"Checkov by Prisma Cloud 3.2.319",
"Checkov by Prisma Cloud 3.2.320",
"Checkov by Prisma Cloud 3.2.321",
"Checkov by Prisma Cloud 3.2.322",
"Checkov by Prisma Cloud 3.2.323",
"Checkov by Prisma Cloud 3.2.324",
"Checkov by Prisma Cloud 3.2.325",
"Checkov by Prisma Cloud 3.2.326",
"Checkov by Prisma Cloud 3.2.327",
"Checkov by Prisma Cloud 3.2.328",
"Checkov by Prisma Cloud 3.2.329",
"Checkov by Prisma Cloud 3.2.330",
"Checkov by Prisma Cloud 3.2.331",
"Checkov by Prisma Cloud 3.2.332",
"Checkov by Prisma Cloud 3.2.333",
"Checkov by Prisma Cloud 3.2.334",
"Checkov by Prisma Cloud 3.2.335",
"Checkov by Prisma Cloud 3.2.336",
"Checkov by Prisma Cloud 3.2.337",
"Checkov by Prisma Cloud 3.2.338",
"Checkov by Prisma Cloud 3.2.339",
"Checkov by Prisma Cloud 3.2.340",
"Checkov by Prisma Cloud 3.2.341",
"Checkov by Prisma Cloud 3.2.342",
"Checkov by Prisma Cloud 3.2.343",
"Checkov by Prisma Cloud 3.2.344",
"Checkov by Prisma Cloud 3.2.345",
"Checkov by Prisma Cloud 3.2.346",
"Checkov by Prisma Cloud 3.2.347",
"Checkov by Prisma Cloud 3.2.348",
"Checkov by Prisma Cloud 3.2.349",
"Checkov by Prisma Cloud 3.2.350",
"Checkov by Prisma Cloud 3.2.351",
"Checkov by Prisma Cloud 3.2.352",
"Checkov by Prisma Cloud 3.2.353",
"Checkov by Prisma Cloud 3.2.354",
"Checkov by Prisma Cloud 3.2.355",
"Checkov by Prisma Cloud 3.2.356",
"Checkov by Prisma Cloud 3.2.357",
"Checkov by Prisma Cloud 3.2.358",
"Checkov by Prisma Cloud 3.2.359",
"Checkov by Prisma Cloud 3.2.360",
"Checkov by Prisma Cloud 3.2.361",
"Checkov by Prisma Cloud 3.2.362",
"Checkov by Prisma Cloud 3.2.363",
"Checkov by Prisma Cloud 3.2.364",
"Checkov by Prisma Cloud 3.2.365",
"Checkov by Prisma Cloud 3.2.366",
"Checkov by Prisma Cloud 3.2.367",
"Checkov by Prisma Cloud 3.2.368",
"Checkov by Prisma Cloud 3.2.369",
"Checkov by Prisma Cloud 3.2.370",
"Checkov by Prisma Cloud 3.2.371",
"Checkov by Prisma Cloud 3.2.372",
"Checkov by Prisma Cloud 3.2.373",
"Checkov by Prisma Cloud 3.2.374",
"Checkov by Prisma Cloud 3.2.375",
"Checkov by Prisma Cloud 3.2.376",
"Checkov by Prisma Cloud 3.2.377",
"Checkov by Prisma Cloud 3.2.378",
"Checkov by Prisma Cloud 3.2.379",
"Checkov by Prisma Cloud 3.2.380",
"Checkov by Prisma Cloud 3.2.381",
"Checkov by Prisma Cloud 3.2.382",
"Checkov by Prisma Cloud 3.2.383",
"Checkov by Prisma Cloud 3.2.384",
"Checkov by Prisma Cloud 3.2.385",
"Checkov by Prisma Cloud 3.2.386",
"Checkov by Prisma Cloud 3.2.387",
"Checkov by Prisma Cloud 3.2.388",
"Checkov by Prisma Cloud 3.2.389",
"Checkov by Prisma Cloud 3.2.390",
"Checkov by Prisma Cloud 3.2.391",
"Checkov by Prisma Cloud 3.2.392",
"Checkov by Prisma Cloud 3.2.393",
"Checkov by Prisma Cloud 3.2.394",
"Checkov by Prisma Cloud 3.2.395",
"Checkov by Prisma Cloud 3.2.396",
"Checkov by Prisma Cloud 3.2.397",
"Checkov by Prisma Cloud 3.2.398",
"Checkov by Prisma Cloud 3.2.399",
"Checkov by Prisma Cloud 3.2.400",
"Checkov by Prisma Cloud 3.2.401",
"Checkov by Prisma Cloud 3.2.402",
"Checkov by Prisma Cloud 3.2.403",
"Checkov by Prisma Cloud 3.2.404",
"Checkov by Prisma Cloud 3.2.405",
"Checkov by Prisma Cloud 3.2.406",
"Checkov by Prisma Cloud 3.2.407",
"Checkov by Prisma Cloud 3.2.408",
"Checkov by Prisma Cloud 3.2.409",
"Checkov by Prisma Cloud 3.2.410",
"Checkov by Prisma Cloud 3.2.411",
"Checkov by Prisma Cloud 3.2.412",
"Checkov by Prisma Cloud 3.2.413",
"Checkov by Prisma Cloud 3.2.414",
"Checkov by Prisma Cloud 3.2.415",
"Checkov by Prisma Cloud 3.2.416",
"Checkov by Prisma Cloud 3.2.417",
"Checkov by Prisma Cloud 3.2.418",
"Checkov by Prisma Cloud 3.2.419",
"Checkov by Prisma Cloud 3.2.420",
"Checkov by Prisma Cloud 3.2.421",
"Checkov by Prisma Cloud 3.2.422",
"Checkov by Prisma Cloud 3.2.423",
"Checkov by Prisma Cloud 3.2.424",
"Checkov by Prisma Cloud 3.2.425",
"Checkov by Prisma Cloud 3.2.426",
"Checkov by Prisma Cloud 3.2.427",
"Checkov by Prisma Cloud 3.2.428",
"Checkov by Prisma Cloud 3.2.429",
"Checkov by Prisma Cloud 3.2.430",
"Checkov by Prisma Cloud 3.2.431",
"Checkov by Prisma Cloud 3.2.432",
"Checkov by Prisma Cloud 3.2.433",
"Checkov by Prisma Cloud 3.2.434",
"Checkov by Prisma Cloud 3.2.435",
"Checkov by Prisma Cloud 3.2.436",
"Checkov by Prisma Cloud 3.2.437",
"Checkov by Prisma Cloud 3.2.438",
"Checkov by Prisma Cloud 3.2.439",
"Checkov by Prisma Cloud 3.2.440",
"Checkov by Prisma Cloud 3.2.441",
"Checkov by Prisma Cloud 3.2.442",
"Checkov by Prisma Cloud 3.2.443",
"Checkov by Prisma Cloud 3.2.444",
"Checkov by Prisma Cloud 3.2.445",
"Checkov by Prisma Cloud 3.2.446",
"Checkov by Prisma Cloud 3.2.447",
"Checkov by Prisma Cloud 3.2.448",
"Checkov by Prisma Cloud 3.2.449",
"Checkov by Prisma Cloud 3.2.450",
"Checkov by Prisma Cloud 3.2.451",
"Checkov by Prisma Cloud 3.2.452",
"Checkov by Prisma Cloud 3.2.453",
"Checkov by Prisma Cloud 3.2.454",
"Checkov by Prisma Cloud 3.2.455",
"Checkov by Prisma Cloud 3.2.456",
"Checkov by Prisma Cloud 3.2.457",
"Checkov by Prisma Cloud 3.2.458",
"Checkov by Prisma Cloud 3.2.459",
"Checkov by Prisma Cloud 3.2.460",
"Checkov by Prisma Cloud 3.2.461",
"Checkov by Prisma Cloud 3.2.462",
"Checkov by Prisma Cloud 3.2.463",
"Checkov by Prisma Cloud 3.2.464",
"Checkov by Prisma Cloud 3.2.465",
"Checkov by Prisma Cloud 3.2.466",
"Checkov by Prisma Cloud 3.2.467",
"Checkov by Prisma Cloud 3.2.468",
"Checkov by Prisma Cloud 3.2.469",
"Checkov by Prisma Cloud 3.2.470",
"Checkov by Prisma Cloud 3.2.471",
"Checkov by Prisma Cloud 3.2.472",
"Checkov by Prisma Cloud 3.2.473",
"Checkov by Prisma Cloud 3.2.474",
"Checkov by Prisma Cloud 3.2.475",
"Checkov by Prisma Cloud 3.2.476",
"Checkov by Prisma Cloud 3.2.477",
"Checkov by Prisma Cloud 3.2.478",
"Checkov by Prisma Cloud 3.2.479",
"Checkov by Prisma Cloud 3.2.480",
"Checkov by Prisma Cloud 3.2.481",
"Checkov by Prisma Cloud 3.2.482",
"Checkov by Prisma Cloud 3.2.483",
"Checkov by Prisma Cloud 3.2.484",
"Checkov by Prisma Cloud 3.2.485",
"Checkov by Prisma Cloud 3.2.486",
"Checkov by Prisma Cloud 3.2.487",
"Checkov by Prisma Cloud 3.2.488",
"Checkov by Prisma Cloud 3.2.489",
"Checkov by Prisma Cloud 3.2.490",
"Checkov by Prisma Cloud 3.2.491",
"Checkov by Prisma Cloud 3.2.492",
"Checkov by Prisma Cloud 3.2.493",
"Checkov by Prisma Cloud 3.2.494",
"Checkov by Prisma Cloud 3.2.495",
"Checkov by Prisma Cloud 3.2.496",
"Checkov by Prisma Cloud 3.2.497",
"Checkov by Prisma Cloud 3.2.498",
"Checkov by Prisma Cloud 3.2.499",
"Checkov by Prisma Cloud 3.2.500",
"Checkov by Prisma Cloud 3.2.501",
"Checkov by Prisma Cloud 3.2.502",
"Checkov by Prisma Cloud 3.2.503",
"Checkov by Prisma Cloud 3.2.504",
"Checkov by Prisma Cloud 3.2.505",
"Checkov by Prisma Cloud 3.2.506",
"Checkov by Prisma Cloud 3.2.507",
"Checkov by Prisma Cloud 3.2.508",
"Checkov by Prisma Cloud 3.2.509",
"Checkov by Prisma Cloud 3.2.510",
"Checkov by Prisma Cloud 3.2.511",
"Checkov by Prisma Cloud 3.2.512",
"Checkov by Prisma Cloud 3.2.513",
"Checkov by Prisma Cloud 3.2.514",
"Checkov by Prisma Cloud 3.2.515",
"Checkov by Prisma Cloud 3.2.516",
"Checkov by Prisma Cloud 3.2.517",
"Checkov by Prisma Cloud 3.2.518",
"Checkov by Prisma Cloud 3.2.519",
"Checkov by Prisma Cloud 3.2.520",
"Checkov by Prisma Cloud 3.2.521",
"Checkov by Prisma Cloud 3.2.522",
"Checkov by Prisma Cloud 3.2.523",
"Checkov by Prisma Cloud 3.2.524",
"Checkov by Prisma Cloud 3.2.525",
"Checkov by Prisma Cloud 3.2.526",
"Checkov by Prisma Cloud 3.2.527",
"Checkov by Prisma Cloud 3.2.528",
"Checkov by Prisma Cloud 3.2.529",
"Checkov by Prisma Cloud 3.2.530",
"Checkov by Prisma Cloud 3.2.531"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0303",
"datePublished": "2026-09-10T06:03:50.513Z",
"dateReserved": "2025-11-03T20:45:01.388Z",
"dateUpdated": "2026-09-10T13:01:27.361Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0304 (GCVE-0-2026-0304)
Vulnerability from cvelistv5 – Published: 2026-09-10 06:02 – Updated: 2026-09-11 03:56
VLAI
EPSS
VEX
Title
Cortex XDR Broker VM: Privilege Escalation Vulnerability
Summary
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 00:00 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0304 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Cortex XDR Broker VM |
Affected:
20.0.96 , < 32.0.52
(custom)
cpe:2.3:a:palo_alto_networks:cortex_xdr_broker_vm:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0304",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:56:03.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cortex XDR Broker VM",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "32.0.52",
"status": "unaffected"
}
],
"lessThan": "32.0.52",
"status": "affected",
"version": "20.0.96",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue on brokers that process cloud-delivered mount actions."
}
],
"value": "No special configuration is required to be affected by this issue on brokers that process cloud-delivered mount actions."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:cortex_xdr_broker_vm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "32.0.52",
"versionStartIncluding": "32.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "internal security research teams"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM."
}
],
"value": "A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T06:02:24.553Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0304"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eThis issue is fixed in Cortex XDR Broker VM 32.0.52, and all later Cortex XDR Broker VM versions.\u003c/span\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan\u003eIf automatic upgrades are enabled for Broker VM, then no action is required at this time.\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e\u003cb\u003e\u003c/b\u003e\u003cul\u003e\u003cli\u003e\u003cp\u003e\u003cspan\u003eIf automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software\u003c/span\u003e\u003c/p\u003e\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "This issue is fixed in Cortex XDR Broker VM 32.0.52, and all later Cortex XDR Broker VM versions.\n\n * If automatic upgrades are enabled for Broker VM, then no action is required at this time.\n\n * If automatic upgrades are not enabled for Broker VM, then we recommend that you do so to ensure that you always have the latest security patches installed in your software"
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Cortex XDR Broker VM: Privilege Escalation Vulnerability",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"Cortex XDR Broker VM 32.0.0",
"Cortex XDR Broker VM 32.0.1",
"Cortex XDR Broker VM 32.0.2",
"Cortex XDR Broker VM 32.0.3",
"Cortex XDR Broker VM 32.0.4",
"Cortex XDR Broker VM 32.0.5",
"Cortex XDR Broker VM 32.0.6",
"Cortex XDR Broker VM 32.0.7",
"Cortex XDR Broker VM 32.0.8",
"Cortex XDR Broker VM 32.0.9",
"Cortex XDR Broker VM 32.0.10",
"Cortex XDR Broker VM 32.0.11",
"Cortex XDR Broker VM 32.0.12",
"Cortex XDR Broker VM 32.0.13",
"Cortex XDR Broker VM 32.0.14",
"Cortex XDR Broker VM 32.0.15",
"Cortex XDR Broker VM 32.0.16",
"Cortex XDR Broker VM 32.0.17",
"Cortex XDR Broker VM 32.0.18",
"Cortex XDR Broker VM 32.0.19",
"Cortex XDR Broker VM 32.0.20",
"Cortex XDR Broker VM 32.0.21",
"Cortex XDR Broker VM 32.0.22",
"Cortex XDR Broker VM 32.0.23",
"Cortex XDR Broker VM 32.0.24",
"Cortex XDR Broker VM 32.0.25",
"Cortex XDR Broker VM 32.0.26",
"Cortex XDR Broker VM 32.0.27",
"Cortex XDR Broker VM 32.0.28",
"Cortex XDR Broker VM 32.0.29",
"Cortex XDR Broker VM 32.0.30",
"Cortex XDR Broker VM 32.0.31",
"Cortex XDR Broker VM 32.0.32",
"Cortex XDR Broker VM 32.0.33",
"Cortex XDR Broker VM 32.0.34",
"Cortex XDR Broker VM 32.0.35",
"Cortex XDR Broker VM 32.0.36",
"Cortex XDR Broker VM 32.0.37",
"Cortex XDR Broker VM 32.0.38",
"Cortex XDR Broker VM 32.0.39",
"Cortex XDR Broker VM 32.0.40",
"Cortex XDR Broker VM 32.0.41",
"Cortex XDR Broker VM 32.0.42",
"Cortex XDR Broker VM 32.0.43",
"Cortex XDR Broker VM 32.0.44",
"Cortex XDR Broker VM 32.0.45",
"Cortex XDR Broker VM 32.0.46",
"Cortex XDR Broker VM 32.0.47",
"Cortex XDR Broker VM 32.0.48",
"Cortex XDR Broker VM 32.0.49",
"Cortex XDR Broker VM 32.0.50",
"Cortex XDR Broker VM 32.0.51"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0304",
"datePublished": "2026-09-10T06:02:24.553Z",
"dateReserved": "2025-11-03T20:45:02.858Z",
"dateUpdated": "2026-09-11T03:56:03.202Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0305 (GCVE-0-2026-0305)
Vulnerability from cvelistv5 – Published: 2026-09-10 05:57 – Updated: 2026-09-10 13:02
VLAI
EPSS
VEX
Title
Prisma Access Agent: Information Disclosure Vulnerability on Linux
Summary
An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credentials.
The Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:02 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0305 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Prisma Access Agent |
Affected:
24.0 , < 26.2
(custom)
cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:linux:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access Agent |
Unaffected:
All , < 6.3.3-h15
(custom)
|
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0305",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:02:33.310473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:02:43.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "26.3",
"status": "unaffected"
}
],
"lessThan": "26.2",
"status": "affected",
"version": "24.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"macOS",
"Windows",
"iOS",
"Android",
"ChromeOS"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eNo special configuration is required to be affected by this issue.\u003c/span\u003e"
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "26.2",
"versionStartIncluding": "24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:ios:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:android:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:chromeos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue."
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eAn information disclosure vulnerability in the Palo Alto Networks Prisma\u00ae Access Agent on Linux enables a local user to access sensitive configuration data and credentials.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThe Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected.\u003c/span\u003e\u003c/p\u003e\u003cb\u003e\u003cp\u003e\u003c/p\u003e\u003c/b\u003e"
}
],
"value": "An information disclosure vulnerability in the Palo Alto Networks Prisma\u00ae Access Agent on Linux enables a local user to access sensitive configuration data and credentials.\n\n\n\nThe Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-118",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-118 Collect and Analyze Information"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:57:01.119Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0305"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003c/th\u003e\u003cth\u003eMinor Version\u003c/th\u003e\u003cth\u003eSuggested Solution\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Linux\u003c/td\u003e\u003ctd\u003e\u003cspan\u003e25.7 through 26.2.2\u003c/span\u003e\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003cspan\u003eUpgrade to 26.3 or later.\u003c/span\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on macOS\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Windows\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on iOS\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Android\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on ChromeOS\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VersionMinor VersionSuggested SolutionPrisma Access Agent on Linux25.7 through 26.2.2\nUpgrade to 26.3 or later.Prisma Access Agent on macOS\u00a0No action needed.Prisma Access Agent on Windows\u00a0No action needed.Prisma Access Agent on iOS\u00a0No action needed.Prisma Access Agent on Android\u00a0No action needed.Prisma Access Agent on ChromeOS\u00a0No action needed."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Prisma Access Agent: Information Disclosure Vulnerability on Linux",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eNo known workarounds or mitigations exist for this issue.\u003c/span\u003e"
}
],
"value": "No known workarounds or mitigations exist for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0305",
"datePublished": "2026-09-10T05:57:01.119Z",
"dateReserved": "2025-11-03T20:45:03.983Z",
"dateUpdated": "2026-09-10T13:02:43.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0306 (GCVE-0-2026-0306)
Vulnerability from cvelistv5 – Published: 2026-09-10 05:55 – Updated: 2026-09-10 13:03
VLAI
EPSS
VEX
Title
Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows
Summary
A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data.
This Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:02 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0306 | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Prisma Access Agent |
Affected:
0 , < 26.2
(custom)
cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:windows:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access Agent |
Unaffected:
All , < 6.3.3-h15
(custom)
|
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:02:56.381680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:03:06.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "26.2",
"status": "unaffected"
}
],
"lessThan": "26.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Linux",
"macOS",
"iOS",
"Android",
"ChromeOS"
],
"product": "Prisma Access Agent",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "26.2",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:ios:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:android:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:prisma_access_agent:*:*:chromeos:*:*:*:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "all",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vladislav Ovitchinikov and Daniel Cuthbert"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eA vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma\u00ae Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data. \u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThis Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not affected.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma\u00ae Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data. \n\n\n\nThis Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not affected."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-212",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-212 Functionality Misuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:55:23.322Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0306"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003c/th\u003e\u003cth\u003eMinor Version\u003c/th\u003e\u003cth\u003eSuggested Solution\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Windows\u003c/td\u003e\u003ctd\u003e\u003cspan\u003e24.0 through 26.2\u003c/span\u003e\u003cbr\u003e\u003c/td\u003e\u003ctd\u003eUpgrade to 26.2 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Linux\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u003cspan\u003eNo action needed.\u003c/span\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on macOS\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on iOS\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on Android\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access Agent on ChromeOS\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "VersionMinor VersionSuggested SolutionPrisma Access Agent on Windows24.0 through 26.2\nUpgrade to 26.2 or later.Prisma Access Agent on Linux\u00a0No action needed.Prisma Access Agent on macOS\u00a0\u00a0No action needed.Prisma Access Agent on iOS\u00a0\u00a0No action needed.\u00a0Prisma Access Agent on Android\u00a0\u00a0No action needed.\u00a0Prisma Access Agent on ChromeOS\u00a0\u00a0No action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0306",
"datePublished": "2026-09-10T05:55:23.322Z",
"dateReserved": "2025-11-03T20:45:04.920Z",
"dateUpdated": "2026-09-10T13:03:06.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0307 (GCVE-0-2026-0307)
Vulnerability from cvelistv5 – Published: 2026-09-10 05:51 – Updated: 2026-09-11 03:56
VLAI
EPSS
VEX
Title
GlobalProtect App: Local Privilege Escalation Vulnerabilities
Summary
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.
This GlobalProtect app on iOS, Android and ChromeOS is not impacted.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 00:00 UTC
CWE
- CWE-426 - Untrusted Search Path
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0307 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h15
(custom)
Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Affected:
6.3.0 , < 6.3.3-h15
(custom)
Affected: 6.2.0 , < 6.2.8-h14 (custom) Affected: 6.0.0 , < 6.0.15 (custom) cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:* |
|
| Palo Alto Networks | GlobalProtect App |
Affected:
All
(custom)
cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:ChromeOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:iOS:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Android:*:* cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:ChromeOS:*:* |
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0307",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:56:04.416Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Linux:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Linux:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Windows:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:macOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Windows:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"macOS",
"Windows"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "6.3.3-h15",
"status": "unaffected"
}
],
"lessThan": "6.3.3-h15",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.2.8-h14",
"status": "unaffected"
}
],
"lessThan": "6.2.8-h14",
"status": "affected",
"version": "6.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "6.0.15",
"status": "unaffected"
}
],
"lessThan": "6.0.15",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.3:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.2:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.1:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.3.0:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.14:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.13:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.12:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.11:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.10:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.8:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.7:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.6:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.5:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.4:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.3:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.2:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.1:*:*:*:*:ChromeOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:iOS:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:Android:*:*",
"cpe:2.3:a:palo_alto_networks:globalprotect_app:6.0.0:*:*:*:*:ChromeOS:*:*"
],
"defaultStatus": "unaffected",
"platforms": [
"iOS",
"Android",
"ChromeOS"
],
"product": "GlobalProtect App",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Linux:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "6.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Linux:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "6.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Windows:*:*",
"versionEndExcluding": "6.3.3-h15",
"versionStartIncluding": "6.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:*",
"versionEndExcluding": "6.2.8-h14",
"versionStartIncluding": "6.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Windows:*:*",
"versionEndExcluding": "6.2.8-h14",
"versionStartIncluding": "6.2.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:macOS:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Windows:*:*",
"versionEndExcluding": "6.0.15",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:iOS:*:*",
"versionStartIncluding": "all",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:Android:*:*",
"versionStartIncluding": "all",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:palo_alto_networks:globalprotect_app:*:*:*:*:*:ChromeOS:*:*",
"versionStartIncluding": "all",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "our internal security research teams"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eMultiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect\u2122 app allows a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003eThis GlobalProtect app on iOS, Android and ChromeOS is not impacted.\u003c/span\u003e\u003c/p\u003e"
}
],
"value": "Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect\u2122 app allows a local user to escalate their privileges to NT AUTHORITY\\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges.\n\n\n\nThis GlobalProtect app on iOS, Android and ChromeOS is not impacted."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-426",
"description": "CWE-426 Untrusted Search Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:51:53.090Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0307"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2/6.3 on Linux\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.3.3-h14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.3.3-h15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.0 on Linux\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.3 on macOS\u003c/td\u003e\u003ctd\u003e6.3.0 through 6.3.3-h14\u003c/td\u003e\u003ctd\u003eUpgrade to 6.3.3-h15 or later.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.2 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.2.0 through 6.2.8-h13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.2.8-h14 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003eGlobalProtect App 6.0 on macOS\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e6.0.0 through 6.0.14\u003c/td\u003e\n \u003ctd\u003eUpgrade to 6.0.15 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.3 on Windows\u003c/td\u003e\u003ctd\u003e6.3.0 through 6.3.3-h14\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to 6.3.3-h15 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.2 on Windows\u0026nbsp;\u003c/td\u003e\u003ctd\u003e6.2.0 through 6.2.8-h13\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to 6.2.8-h14 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App 6.0 on Windows\u003c/td\u003e\u003ctd\u003e6.0.0 through 6.0.14\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to 6.0.15 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on iOS\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on Android\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eGlobalProtect App on ChromeOS\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eNo action needed.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 12.2\u003c/td\u003e\u003ctd\u003e12.2.0 through 12.2.2\u2003\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to 12.2.3 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 12.1\u003c/td\u003e\u003ctd\u003e12.1.8 through 12.1.9\u003c/td\u003e\u003ctd\u003eUpgrade to 12.1.10 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e12.1.5 through 12.1.7-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 12.1.7-h5 or 12.1.10 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e12.1.2 through 12.1.4-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 12.1.4-h10 or 12.1.10 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 11.2\u003c/td\u003e\u003ctd\u003e11.2.11 through 11.2.13-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.2.13-h2 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.2.8 through 11.2.10-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.2.10-h14 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.2.5 through 11.2.7-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.2.7-h20 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.2.0 through 11.2.4-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.2.4-h21 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 11.1\u003c/td\u003e\u003ctd\u003e11.1.14 through 11.1.16-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.16 or 11.1.16-h2 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.1.11 through 11.1.13-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.13-h12 or 11.1.16 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.1.8 through 11.1.10-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.10-h33 or 11.1.16 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.1.7 through 11.1.7-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.7-h10 or 11.1.16 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.1.5 through 11.1.6-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.6-h38 or 11.1.16 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e11.1.0 through 11.1.4-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.1.4-h36 or 11.1.16 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePAN-OS 10.2\u003c/td\u003e\u003ctd\u003e10.2.17 through 10.2.18-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.18-h10 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e10.2.14 through 10.2.16-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.16-h10 or 10.2.18 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e10.2.11 through 10.2.13-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.13-h24 or 10.2.18 or later.\u0026nbsp;\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e10.2.8 through 10.2.10-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.10-h40 or 10.2.18 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e10.2.0 through 10.2.7-h*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.7-h37 or 10.2.18 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older\u0026nbsp;unsupported\u0026nbsp;PAN-OS versions\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access 12.1\u003c/td\u003e\u003ctd\u003e12.1.2 through 12.1.*\u003c/td\u003e\u003ctd\u003eUpgrade to 12.1.7-h5 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access 11.2\u003c/td\u003e\u003ctd\u003e11.2.0 through 11.2*\u003c/td\u003e\u003ctd\u003eUpgrade to 11.2.7-h20 or later.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access 10.2\u003c/td\u003e\u003ctd\u003e10.2.0 through 10.2.*\u003c/td\u003e\u003ctd\u003eUpgrade to 10.2.10-h40 or later.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "Version\nMinor Version\nSuggested Solution\n\n GlobalProtect App 6.2/6.3 on Linux\n\n 6.2.0 through 6.3.3-h14\n Upgrade to 6.3.3-h15 or later.\n \n GlobalProtect App 6.0 on Linux\n\n 6.0.0 through 6.0.14\n Upgrade to 6.0.15 or later.\n GlobalProtect App 6.3 on macOS6.3.0 through 6.3.3-h14Upgrade to 6.3.3-h15 or later.\n\n GlobalProtect App 6.2 on macOS\n\n 6.2.0 through 6.2.8-h13\n Upgrade to 6.2.8-h14 or later.\n \n GlobalProtect App 6.0 on macOS\n\n 6.0.0 through 6.0.14\n Upgrade to 6.0.15 or later.\n GlobalProtect App 6.3 on Windows6.3.0 through 6.3.3-h14\u00a0Upgrade to 6.3.3-h15 or later.\u00a0GlobalProtect App 6.2 on Windows\u00a06.2.0 through 6.2.8-h13\u00a0Upgrade to 6.2.8-h14 or later.\u00a0GlobalProtect App 6.0 on Windows6.0.0 through 6.0.14\u00a0Upgrade to 6.0.15 or later.\u00a0GlobalProtect App on iOS\u00a0\u00a0No action needed.GlobalProtect App on Android\u00a0\u00a0No action needed.\u00a0GlobalProtect App on ChromeOS\u00a0\u00a0No action needed.\u00a0PAN-OS 12.212.2.0 through 12.2.2\u2003\u00a0Upgrade to 12.2.3 or later.\u00a0PAN-OS 12.112.1.8 through 12.1.9Upgrade to 12.1.10 or later.\u00a012.1.5 through 12.1.7-h*Upgrade to 12.1.7-h5 or 12.1.10 or later.\u00a012.1.2 through 12.1.4-h*Upgrade to 12.1.4-h10 or 12.1.10 or later.PAN-OS 11.211.2.11 through 11.2.13-h*Upgrade to 11.2.13-h2 or later.\u00a011.2.8 through 11.2.10-h*Upgrade to 11.2.10-h14 or later.\u00a011.2.5 through 11.2.7-h*Upgrade to 11.2.7-h20 or later.\u00a011.2.0 through 11.2.4-h*Upgrade to 11.2.4-h21 or later.PAN-OS 11.111.1.14 through 11.1.16-h*Upgrade to 11.1.16 or 11.1.16-h2 or later.\u00a011.1.11 through 11.1.13-h*Upgrade to 11.1.13-h12 or 11.1.16 or later.\u00a011.1.8 through 11.1.10-h*Upgrade to 11.1.10-h33 or 11.1.16 or later.\u00a011.1.7 through 11.1.7-h*Upgrade to 11.1.7-h10 or 11.1.16 or later.\u00a011.1.5 through 11.1.6-h*Upgrade to 11.1.6-h38 or 11.1.16 or later.\u00a011.1.0 through 11.1.4-h*Upgrade to 11.1.4-h36 or 11.1.16 or later.PAN-OS 10.210.2.17 through 10.2.18-h*Upgrade to 10.2.18-h10 or later.\u00a010.2.14 through 10.2.16-h*Upgrade to 10.2.16-h10 or 10.2.18 or later.\u00a010.2.11 through 10.2.13-h*Upgrade to 10.2.13-h24 or 10.2.18 or later.\u00a0\u00a010.2.8 through 10.2.10-h*Upgrade to 10.2.10-h40 or 10.2.18 or later.\u00a010.2.0 through 10.2.7-h*Upgrade to 10.2.7-h37 or 10.2.18 or later.All older\u00a0unsupported\u00a0PAN-OS versions\u00a0Upgrade to a supported fixed version.Prisma Access 12.112.1.2 through 12.1.*Upgrade to 12.1.7-h5 or later.Prisma Access 11.211.2.0 through 11.2*Upgrade to 11.2.7-h20 or later.Prisma Access 10.210.2.0 through 10.2.*Upgrade to 10.2.10-h40 or later."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication."
}
],
"title": "GlobalProtect App: Local Privilege Escalation Vulnerabilities",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"GlobalProtect App 6.3.3",
"GlobalProtect App 6.3.2",
"GlobalProtect App 6.3.1",
"GlobalProtect App 6.3.0",
"GlobalProtect App 6.3",
"GlobalProtect App 6.0.14",
"GlobalProtect App 6.0.13",
"GlobalProtect App 6.0.12",
"GlobalProtect App 6.0.11",
"GlobalProtect App 6.0.10",
"GlobalProtect App 6.0.8",
"GlobalProtect App 6.0.7",
"GlobalProtect App 6.0.6",
"GlobalProtect App 6.0.5",
"GlobalProtect App 6.0.4",
"GlobalProtect App 6.0.3",
"GlobalProtect App 6.0.2",
"GlobalProtect App 6.0.1",
"GlobalProtect App 6.0.0",
"GlobalProtect App 6.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0307",
"datePublished": "2026-09-10T05:51:53.090Z",
"dateReserved": "2025-11-03T20:45:06.164Z",
"dateUpdated": "2026-09-11T03:56:04.416Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0308 (GCVE-0-2026-0308)
Vulnerability from cvelistv5 – Published: 2026-09-10 05:48 – Updated: 2026-09-10 13:04
VLAI
EPSS
VEX
Title
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
Summary
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface.
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:03 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0308 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW |
Unaffected:
All
(custom)
|
|
| Palo Alto Networks | PAN-OS |
Unaffected:
12.2.0 , < 12.2.3
(custom)
Affected: 12.1.0 , < 12.1.10 (custom) Affected: 11.2.0 , < 11.2.13-h2 (custom) Affected: 11.1.0 , < 11.1.16-h2 (custom) cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access |
Unaffected:
All , < 12.1.4-h10
(custom)
|
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0308",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:03:47.811775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:04:03.221Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud NGFW",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "PAN-OS",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.2.3",
"status": "unaffected"
}
],
"lessThan": "12.2.3",
"status": "unaffected",
"version": "12.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "12.1.10",
"status": "unaffected"
}
],
"lessThan": "12.1.10",
"status": "affected",
"version": "12.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.2.13-h2",
"status": "unaffected"
}
],
"lessThan": "11.2.13-h2",
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.1.16-h2",
"status": "unaffected"
}
],
"lessThan": "11.1.16-h2",
"status": "affected",
"version": "11.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"product": "Prisma Access",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.1.7-h5",
"status": "unaffected"
}
],
"lessThan": "12.1.4-h10",
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan\u003eNo special configuration is required to be affected by this issue.\u003c/span\u003e"
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.13-h2",
"versionStartIncluding": "11.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.16-h2",
"versionStartIncluding": "11.1.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Micha\u0142 Skowron and Tomasz Stachowicz of ING Hubs Poland and James Otten (internal reporter)"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS\u00ae software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. \u003cbr\u003e\u003cbr\u003eThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). \u003cbr\u003e\u003cbr\u003eCloud NGFW and Prisma\u00ae Access are not affected by this vulnerability."
}
],
"value": "A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS\u00ae software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. \n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). \n\nCloud NGFW and Prisma\u00ae Access are not affected by this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-592",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-592 Stored XSS"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 1.1,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "The risk is highest when you allow access to the management interface from external IP addresses on the internet."
}
]
},
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 0.4,
"baseSeverity": "LOW",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:48:46.726Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0308"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cspan\u003eCloud NGFW\u003c/span\u003e\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003cspan\u003eNo action needed.\u003c/span\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cspan\u003ePAN-OS 12.2\u003c/span\u003e\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003cspan\u003eNo action needed.\u003c/span\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 12.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.2 through 12.1.9\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.0 through 11.2.13\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.13-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.0 through 11.1.16\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.16-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older\u003cbr\u003eunsupported\u003cbr\u003ePAN-OS versions\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "Version\nMinor Version\nSuggested Solution\nCloud NGFW\u00a0\u00a0No action needed.PAN-OS 12.2\u00a0\u00a0No action needed.\n PAN-OS 12.1\n\n 12.1.2 through 12.1.9\n Upgrade to 12.1.10 or later.\n \n PAN-OS 11.2\n\n 11.2.0 through 11.2.13\n Upgrade to 11.2.13-h2 or later.\n \n PAN-OS 11.1\n\n 11.1.0 through 11.1.16\n Upgrade to 11.1.16-h2 or later.\n All older\nunsupported\nPAN-OS versions\u00a0Upgrade to a supported fixed version.Prisma AccessNo action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eCustomers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510040 and 510041 (from Applications and Threats content version 9145-10233 and later). For these Threat IDs to protect against attacks for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id59206398-3dab-4b2f-9b4b-7ea500d036ba\"\u003eRoute incoming traffic for the MGT port through a DP port\u003c/a\u003e, e.g., enabling management profile on a DP interface for management access.\u003cbr\u003e\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id112f7714-8995-4496-bbf9-781e63dec71c\"\u003eReplace the Certificate for Inbound Traffic Management\u003c/a\u003e.\u003c/li\u003e\u003cli\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#idbbd82587-17a2-42b4-9245-d3714e1e13a2\"\u003eDecrypt inbound traffic to the management interface so the firewall can inspect it\u003c/a\u003e.\u003c/li\u003e\u003cli\u003eEnable threat prevention on the inbound traffic to management services.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003ePlease note that this Threat ID requires SSL Decryption.\u003c/p\u003e"
}
],
"value": "No known workarounds exist for this issue.\n\n\n\nCustomers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510040 and 510041 (from Applications and Threats content version 9145-10233 and later). For these Threat IDs to protect against attacks for this vulnerability:\n\n * Route incoming traffic for the MGT port through a DP port https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id59206398-3dab-4b2f-9b4b-7ea500d036ba , e.g., enabling management profile on a DP interface for management access.\n\n * Replace the Certificate for Inbound Traffic Management https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id112f7714-8995-4496-bbf9-781e63dec71c .\n * Decrypt inbound traffic to the management interface so the firewall can inspect it https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#idbbd82587-17a2-42b4-9245-d3714e1e13a2 .\n * Enable threat prevention on the inbound traffic to management services.\n\n\n\n\nPlease note that this Threat ID requires SSL Decryption."
}
],
"x_affectedList": [
"PAN-OS 12.1.9",
"PAN-OS 12.1.8",
"PAN-OS 12.1.7-h3",
"PAN-OS 12.1.7-h2",
"PAN-OS 12.1.7-h1",
"PAN-OS 12.1.7",
"PAN-OS 12.1.6",
"PAN-OS 12.1.5",
"PAN-OS 12.1.4-h9",
"PAN-OS 12.1.4-h8",
"PAN-OS 12.1.4-h7",
"PAN-OS 12.1.4-h6",
"PAN-OS 12.1.4-h5",
"PAN-OS 12.1.4-h3",
"PAN-OS 12.1.4-h2",
"PAN-OS 12.1.4",
"PAN-OS 12.1.3-h3",
"PAN-OS 12.1.3-h1",
"PAN-OS 12.1.3",
"PAN-OS 12.1.2",
"PAN-OS 11.2.13-h1",
"PAN-OS 11.2.13",
"PAN-OS 11.2.12",
"PAN-OS 11.2.11",
"PAN-OS 11.2.10-h13",
"PAN-OS 11.2.10-h12",
"PAN-OS 11.2.10-h10",
"PAN-OS 11.2.10-h9",
"PAN-OS 11.2.10-h8",
"PAN-OS 11.2.10-h7",
"PAN-OS 11.2.10-h6",
"PAN-OS 11.2.10-h5",
"PAN-OS 11.2.10-h4",
"PAN-OS 11.2.10-h3",
"PAN-OS 11.2.10-h2",
"PAN-OS 11.2.10-h1",
"PAN-OS 11.2.10",
"PAN-OS 11.2.9",
"PAN-OS 11.2.8",
"PAN-OS 11.2.7-h19",
"PAN-OS 11.2.7-h18",
"PAN-OS 11.2.7-h17",
"PAN-OS 11.2.7-h16",
"PAN-OS 11.2.7-h15",
"PAN-OS 11.2.7-h14",
"PAN-OS 11.2.7-h13",
"PAN-OS 11.2.7-h12",
"PAN-OS 11.2.7-h11",
"PAN-OS 11.2.7-h10",
"PAN-OS 11.2.7-h8",
"PAN-OS 11.2.7-h7",
"PAN-OS 11.2.7-h4",
"PAN-OS 11.2.7-h3",
"PAN-OS 11.2.7-h2",
"PAN-OS 11.2.7-h1",
"PAN-OS 11.2.7",
"PAN-OS 11.2.6",
"PAN-OS 11.2.5",
"PAN-OS 11.2.4-h20",
"PAN-OS 11.2.4-h18",
"PAN-OS 11.2.4-h17",
"PAN-OS 11.2.4-h15",
"PAN-OS 11.2.4-h14",
"PAN-OS 11.2.4-h12",
"PAN-OS 11.2.4-h11",
"PAN-OS 11.2.4-h10",
"PAN-OS 11.2.4-h9",
"PAN-OS 11.2.4-h8",
"PAN-OS 11.2.4-h7",
"PAN-OS 11.2.4-h6",
"PAN-OS 11.2.4-h5",
"PAN-OS 11.2.4-h4",
"PAN-OS 11.2.4-h3",
"PAN-OS 11.2.4-h2",
"PAN-OS 11.2.4-h1",
"PAN-OS 11.2.4",
"PAN-OS 11.2.3-h5",
"PAN-OS 11.2.3-h4",
"PAN-OS 11.2.3-h3",
"PAN-OS 11.2.3-h2",
"PAN-OS 11.2.3-h1",
"PAN-OS 11.2.3",
"PAN-OS 11.2.2-h2",
"PAN-OS 11.2.2-h1",
"PAN-OS 11.2.1-h1",
"PAN-OS 11.2.1",
"PAN-OS 11.2.0-h1",
"PAN-OS 11.2.0",
"PAN-OS 11.1.16-h1",
"PAN-OS 11.1.16",
"PAN-OS 11.1.15",
"PAN-OS 11.1.14",
"PAN-OS 11.1.13-h11",
"PAN-OS 11.1.13-h10",
"PAN-OS 11.1.13-h9",
"PAN-OS 11.1.13-h8",
"PAN-OS 11.1.13-h7",
"PAN-OS 11.1.13-h6",
"PAN-OS 11.1.13-h5",
"PAN-OS 11.1.13-h3",
"PAN-OS 11.1.13-h2",
"PAN-OS 11.1.13-h1",
"PAN-OS 11.1.13",
"PAN-OS 11.1.12",
"PAN-OS 11.1.11",
"PAN-OS 11.1.10-h32",
"PAN-OS 11.1.10-h30",
"PAN-OS 11.1.10-h28",
"PAN-OS 11.1.10-h27",
"PAN-OS 11.1.10-h26",
"PAN-OS 11.1.10-h25",
"PAN-OS 11.1.10-h21",
"PAN-OS 11.1.10-h12",
"PAN-OS 11.1.10-h10",
"PAN-OS 11.1.10-h9",
"PAN-OS 11.1.10-h7",
"PAN-OS 11.1.10-h5",
"PAN-OS 11.1.10-h4",
"PAN-OS 11.1.10-h1",
"PAN-OS 11.1.10",
"PAN-OS 11.1.9",
"PAN-OS 11.1.8",
"PAN-OS 11.1.6-h36",
"PAN-OS 11.1.6-h35",
"PAN-OS 11.1.6-h34",
"PAN-OS 11.1.6-h33",
"PAN-OS 11.1.6-h32",
"PAN-OS 11.1.6-h29",
"PAN-OS 11.1.6-h25",
"PAN-OS 11.1.6-h23",
"PAN-OS 11.1.6-h22",
"PAN-OS 11.1.6-h21",
"PAN-OS 11.1.6-h20",
"PAN-OS 11.1.6-h19",
"PAN-OS 11.1.6-h18",
"PAN-OS 11.1.6-h17",
"PAN-OS 11.1.6-h14",
"PAN-OS 11.1.6-h10",
"PAN-OS 11.1.6-h7",
"PAN-OS 11.1.6-h6",
"PAN-OS 11.1.6-h4",
"PAN-OS 11.1.6-h3",
"PAN-OS 11.1.6-h2",
"PAN-OS 11.1.6-h1",
"PAN-OS 11.1.6",
"PAN-OS 11.1.5-h1",
"PAN-OS 11.1.5",
"PAN-OS 11.1.4-h35",
"PAN-OS 11.1.4-h34",
"PAN-OS 11.1.4-h33",
"PAN-OS 11.1.4-h32",
"PAN-OS 11.1.4-h27",
"PAN-OS 11.1.4-h25",
"PAN-OS 11.1.4-h18",
"PAN-OS 11.1.4-h17",
"PAN-OS 11.1.4-h15",
"PAN-OS 11.1.4-h13",
"PAN-OS 11.1.4-h12",
"PAN-OS 11.1.4-h11",
"PAN-OS 11.1.4-h10",
"PAN-OS 11.1.4-h9",
"PAN-OS 11.1.4-h8",
"PAN-OS 11.1.4-h7",
"PAN-OS 11.1.4-h6",
"PAN-OS 11.1.4-h5",
"PAN-OS 11.1.4-h4",
"PAN-OS 11.1.4-h3",
"PAN-OS 11.1.4-h2",
"PAN-OS 11.1.4-h1",
"PAN-OS 11.1.4",
"PAN-OS 11.1.3-h13",
"PAN-OS 11.1.3-h12",
"PAN-OS 11.1.3-h11",
"PAN-OS 11.1.3-h10",
"PAN-OS 11.1.3-h9",
"PAN-OS 11.1.3-h8",
"PAN-OS 11.1.3-h7",
"PAN-OS 11.1.3-h6",
"PAN-OS 11.1.3-h5",
"PAN-OS 11.1.3-h4",
"PAN-OS 11.1.3-h3",
"PAN-OS 11.1.3-h2",
"PAN-OS 11.1.3-h1",
"PAN-OS 11.1.3",
"PAN-OS 11.1.2-h18",
"PAN-OS 11.1.2-h17",
"PAN-OS 11.1.2-h16",
"PAN-OS 11.1.2-h15",
"PAN-OS 11.1.2-h14",
"PAN-OS 11.1.2-h13",
"PAN-OS 11.1.2-h12",
"PAN-OS 11.1.2-h11",
"PAN-OS 11.1.2-h10",
"PAN-OS 11.1.2-h9",
"PAN-OS 11.1.2-h8",
"PAN-OS 11.1.2-h7",
"PAN-OS 11.1.2-h6",
"PAN-OS 11.1.2-h5",
"PAN-OS 11.1.2-h4",
"PAN-OS 11.1.2-h3",
"PAN-OS 11.1.2-h2",
"PAN-OS 11.1.2-h1",
"PAN-OS 11.1.2",
"PAN-OS 11.1.1-h2",
"PAN-OS 11.1.1-h1",
"PAN-OS 11.1.1",
"PAN-OS 11.1.0-h4",
"PAN-OS 11.1.0-h3",
"PAN-OS 11.1.0-h2",
"PAN-OS 11.1.0-h1",
"PAN-OS 11.1.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0308",
"datePublished": "2026-09-10T05:48:46.726Z",
"dateReserved": "2025-11-03T20:45:07.021Z",
"dateUpdated": "2026-09-10T13:04:03.221Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0309 (GCVE-0-2026-0309)
Vulnerability from cvelistv5 – Published: 2026-09-10 05:44 – Updated: 2026-09-11 03:56
VLAI
EPSS
VEX
Title
PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration
Summary
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM).
The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.
Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0309 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW |
Unaffected:
All
(custom)
|
|
| Palo Alto Networks | PAN-OS |
Affected:
12.2.0 , < 12.2.3
(custom)
Affected: 12.1.0 , < 12.1.4-h10 (custom) Affected: 11.2.0 , < 11.2.4-h21 (custom) Affected: 11.1.0 , < 11.1.4-h36 (custom) Affected: 10.2.0 , < 10.2.7-h37 (custom) cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h30:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h28:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h26:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h33:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h29:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h33:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.17:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h39:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h37:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h31:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h30:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h24:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access |
Unaffected:
All , < 12.1.4-h10
(custom)
|
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0309",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:56:05.594Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Cloud NGFW",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h30:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h28:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h26:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h33:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h29:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h33:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.17:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h39:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h37:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h31:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h30:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h24:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "PAN-OS",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.2.3",
"status": "unaffected"
}
],
"lessThan": "12.2.3",
"status": "affected",
"version": "12.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "12.1.10",
"status": "unaffected"
},
{
"at": "12.1.7-h5",
"status": "unaffected"
},
{
"at": "12.1.4-h10",
"status": "unaffected"
}
],
"lessThan": "12.1.4-h10",
"status": "affected",
"version": "12.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.2.13-h2",
"status": "unaffected"
},
{
"at": "11.2.10-h14",
"status": "unaffected"
},
{
"at": "11.2.7-h20",
"status": "unaffected"
},
{
"at": "11.2.4-h21",
"status": "unaffected"
}
],
"lessThan": "11.2.4-h21",
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.1.16-h2",
"status": "unaffected"
},
{
"at": "11.1.13-h12",
"status": "unaffected"
},
{
"at": "11.1.10-h33",
"status": "unaffected"
},
{
"at": "11.1.7-h10",
"status": "unaffected"
},
{
"at": "11.1.6-h38",
"status": "unaffected"
},
{
"at": "11.1.4-h36",
"status": "unaffected"
}
],
"lessThan": "11.1.4-h36",
"status": "affected",
"version": "11.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "10.2.18-h10",
"status": "unaffected"
},
{
"at": "10.2.16-h10",
"status": "unaffected"
},
{
"at": "10.2.13-h24",
"status": "unaffected"
},
{
"at": "10.2.10-h40",
"status": "unaffected"
},
{
"at": "10.2.7-h37",
"status": "unaffected"
}
],
"lessThan": "10.2.7-h37",
"status": "affected",
"version": "10.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Prisma Access",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.1.7-h5",
"status": "unaffected"
}
],
"lessThan": "12.1.4-h10",
"status": "unaffected",
"version": "All",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis issue is only applicable to PAN-OS firewalls configured with a \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/secure-keys-with-hardware-security-module/set-up-connectivity-with-hsm-pan-os/set-up-connectivity-with-safenet-network-hsm\"\u003eLuna Hardware Security Module (HSM)\u003c/a\u003e.\u003cbr\u003eTo check if a PAN-OS device has Luna Hardware Security Module (HSM) configured:\u003c/p\u003e\u003col\u003e\u003cli\u003eLog in to the firewall web interface.\u003c/li\u003e\u003cli\u003eNavigate to Device \u0026gt; Setup \u0026gt; HSM.\u003c/li\u003e\u003cli\u003eCheck the Setup Hardware Security Module section:\u003cbr\u003eIf HSM setting fields are displayed your device is affected.\u003c/li\u003e\u003c/ol\u003e"
}
],
"value": "This issue is only applicable to PAN-OS firewalls configured with a Luna Hardware Security Module (HSM) https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/secure-keys-with-hardware-security-module/set-up-connectivity-with-hsm-pan-os/set-up-connectivity-with-safenet-network-hsm .\nTo check if a PAN-OS device has Luna Hardware Security Module (HSM) configured:\n\n * Log in to the firewall web interface.\n * Navigate to Device \u003e Setup \u003e HSM.\n * Check the Setup Hardware Security Module section:\nIf HSM setting fields are displayed your device is affected."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.2.3",
"versionStartIncluding": "12.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.7-h5",
"versionStartIncluding": "12.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.4-h10",
"versionStartIncluding": "12.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.13-h2",
"versionStartIncluding": "11.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.10-h14",
"versionStartIncluding": "11.2.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.7-h20",
"versionStartIncluding": "11.2.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.4-h21",
"versionStartIncluding": "11.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.16-h2",
"versionStartIncluding": "11.1.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.13-h12",
"versionStartIncluding": "11.1.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.10-h33",
"versionStartIncluding": "11.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.7-h10",
"versionStartIncluding": "11.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.6-h38",
"versionStartIncluding": "11.1.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.4-h36",
"versionStartIncluding": "11.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.18-h10",
"versionStartIncluding": "10.2.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.16-h10",
"versionStartIncluding": "10.2.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.13-h24",
"versionStartIncluding": "10.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.10-h40",
"versionStartIncluding": "10.2.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.7-h37",
"versionStartIncluding": "10.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Fran\u00e7ois Rigault"
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A command injection vulnerability in Palo Alto Networks PAN-OS\u00ae software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). \u003cbr\u003e\u003cbr\u003eThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.\u003cbr\u003e\u003cbr\u003ePanorama, Cloud NGFW, and Prisma\u00ae Access are not impacted by this vulnerability."
}
],
"value": "A command injection vulnerability in Palo Alto Networks PAN-OS\u00ae software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device must be configured with a Luna Hardware Security Module (HSM). \n\nThe security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators.\n\nPanorama, Cloud NGFW, and Prisma\u00ae Access are not impacted by this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "HIGH",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:44:10.148Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0309"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eCloud NGFW\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 12.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e12.2.0 through 12.2.2\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.2.3 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 12.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.8 through 12.1.9\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.5 through 12.1.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.7-h5 or 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.2 through 12.1.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.4-h10 or 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.2\u003c/td\u003e\n \u003ctd\u003e11.2.11 through 11.2.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.13-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.8 through 11.2.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.10-h14 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.5 through 11.2.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.7-h20 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.0 through 11.2.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.4-h21 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.14 through 11.1.16-h*\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003eUpgrade or 11.1.16-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.11 through 11.1.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.13-h12 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.8 through 11.1.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.10-h33\u0026nbsp; or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.7 through 11.1.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.7-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.5 through 11.1.6-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.6-h38 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.0 through 11.1.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.4-h36 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 10.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.17 through \u003cbr\u003e10.2.18-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.18-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.14 through 10.2.16-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.16-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.11 through 10.2.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.13-h24 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.8 through 10.2.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.10-h40 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.0 through 10.2.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.7-h37 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older\u003cbr\u003eunsupported\u003cbr\u003ePAN-OS versions\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access\u0026nbsp;\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eNo action needed.\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e"
}
],
"value": "Version\nMinor Version\nSuggested Solution\nCloud NGFW\u00a0No action needed.\n PAN-OS 12.2\n\n 12.2.0 through 12.2.2\n Upgrade to 12.2.3 or later.\n \n PAN-OS 12.1\n\n 12.1.8 through 12.1.9\n Upgrade to 12.1.10 or later.\n \n \n 12.1.5 through 12.1.7-h*\n Upgrade to 12.1.7-h5 or 12.1.10 or later.\n \n \n 12.1.2 through 12.1.4-h*\n Upgrade to 12.1.4-h10 or 12.1.10 or later.\n \n PAN-OS 11.2\n 11.2.11 through 11.2.13-h*\n Upgrade to 11.2.13-h2 or later.\n \n \n 11.2.8 through 11.2.10-h*\n Upgrade to 11.2.10-h14 or later.\n \n \n 11.2.5 through 11.2.7-h*\n Upgrade to 11.2.7-h20 or later.\n \n \n 11.2.0 through 11.2.4-h*\n Upgrade to 11.2.4-h21 or later.\n \n PAN-OS 11.1\n\n 11.1.14 through 11.1.16-h*\n\n Upgrade or 11.1.16-h2 or later.\n \n \n 11.1.11 through 11.1.13-h*\n Upgrade to 11.1.13-h12 or later.\n \n \n 11.1.8 through 11.1.10-h*\n Upgrade to 11.1.10-h33\u00a0 or later.\n \n \n 11.1.7 through 11.1.7-h*\n Upgrade to 11.1.7-h10 or later.\n \n \n 11.1.5 through 11.1.6-h*\n Upgrade to 11.1.6-h38 or later.\n \n \n 11.1.0 through 11.1.4-h*\n Upgrade to 11.1.4-h36 or later.\n \n PAN-OS 10.2\n\n 10.2.17 through \n10.2.18-h*\n Upgrade to 10.2.18-h10 or later.\n \n \n 10.2.14 through 10.2.16-h*\n Upgrade to 10.2.16-h10 or later.\n \n \n 10.2.11 through 10.2.13-h*\n Upgrade to 10.2.13-h24 or later.\n \n \n 10.2.8 through 10.2.10-h*\n Upgrade to 10.2.10-h40 or later.\n \n \n 10.2.0 through 10.2.7-h*\n Upgrade to 10.2.7-h37 or later.\n All older\nunsupported\nPAN-OS versions\u00a0Upgrade to a supported fixed version.Prisma Access\u00a0\nNo action needed."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"PAN-OS 12.2.2",
"PAN-OS 12.1.9",
"PAN-OS 12.1.8",
"PAN-OS 12.1.7-h3",
"PAN-OS 12.1.7-h2",
"PAN-OS 12.1.7-h1",
"PAN-OS 12.1.7",
"PAN-OS 12.1.6",
"PAN-OS 12.1.5",
"PAN-OS 12.1.4-h9",
"PAN-OS 12.1.4-h8",
"PAN-OS 12.1.4-h7",
"PAN-OS 12.1.4-h6",
"PAN-OS 12.1.4-h5",
"PAN-OS 12.1.4-h3",
"PAN-OS 12.1.4-h2",
"PAN-OS 12.1.4",
"PAN-OS 12.1.3-h3",
"PAN-OS 12.1.3-h1",
"PAN-OS 12.1.3",
"PAN-OS 12.1.2",
"PAN-OS 11.2.13-h1",
"PAN-OS 11.2.13",
"PAN-OS 11.2.12",
"PAN-OS 11.2.11",
"PAN-OS 11.2.10-h13",
"PAN-OS 11.2.10-h12",
"PAN-OS 11.2.10-h10",
"PAN-OS 11.2.10-h9",
"PAN-OS 11.2.10-h8",
"PAN-OS 11.2.10-h7",
"PAN-OS 11.2.10-h6",
"PAN-OS 11.2.10-h5",
"PAN-OS 11.2.10-h4",
"PAN-OS 11.2.10-h3",
"PAN-OS 11.2.10-h2",
"PAN-OS 11.2.10-h1",
"PAN-OS 11.2.10",
"PAN-OS 11.2.9",
"PAN-OS 11.2.8",
"PAN-OS 11.2.7-h19",
"PAN-OS 11.2.7-h18",
"PAN-OS 11.2.7-h17",
"PAN-OS 11.2.7-h16",
"PAN-OS 11.2.7-h15",
"PAN-OS 11.2.7-h14",
"PAN-OS 11.2.7-h13",
"PAN-OS 11.2.7-h12",
"PAN-OS 11.2.7-h11",
"PAN-OS 11.2.7-h10",
"PAN-OS 11.2.7-h8",
"PAN-OS 11.2.7-h7",
"PAN-OS 11.2.7-h4",
"PAN-OS 11.2.7-h3",
"PAN-OS 11.2.7-h2",
"PAN-OS 11.2.7-h1",
"PAN-OS 11.2.7",
"PAN-OS 11.2.6",
"PAN-OS 11.2.5",
"PAN-OS 11.2.4-h20",
"PAN-OS 11.2.4-h18",
"PAN-OS 11.2.4-h17",
"PAN-OS 11.2.4-h15",
"PAN-OS 11.2.4-h14",
"PAN-OS 11.2.4-h12",
"PAN-OS 11.2.4-h11",
"PAN-OS 11.2.4-h10",
"PAN-OS 11.2.4-h9",
"PAN-OS 11.2.4-h8",
"PAN-OS 11.2.4-h7",
"PAN-OS 11.2.4-h6",
"PAN-OS 11.2.4-h5",
"PAN-OS 11.2.4-h4",
"PAN-OS 11.2.4-h3",
"PAN-OS 11.2.4-h2",
"PAN-OS 11.2.4-h1",
"PAN-OS 11.2.4",
"PAN-OS 11.2.3-h5",
"PAN-OS 11.2.3-h4",
"PAN-OS 11.2.3-h3",
"PAN-OS 11.2.3-h2",
"PAN-OS 11.2.3-h1",
"PAN-OS 11.2.3",
"PAN-OS 11.2.2-h2",
"PAN-OS 11.2.2-h1",
"PAN-OS 11.2.1-h1",
"PAN-OS 11.2.1",
"PAN-OS 11.2.0-h1",
"PAN-OS 11.2.0",
"PAN-OS 11.1.16-h1",
"PAN-OS 11.1.16",
"PAN-OS 11.1.15",
"PAN-OS 11.1.14",
"PAN-OS 11.1.13-h11",
"PAN-OS 11.1.13-h10",
"PAN-OS 11.1.13-h9",
"PAN-OS 11.1.13-h8",
"PAN-OS 11.1.13-h7",
"PAN-OS 11.1.13-h6",
"PAN-OS 11.1.13-h5",
"PAN-OS 11.1.13-h3",
"PAN-OS 11.1.13-h2",
"PAN-OS 11.1.13-h1",
"PAN-OS 11.1.13",
"PAN-OS 11.1.12",
"PAN-OS 11.1.11",
"PAN-OS 11.1.10-h32",
"PAN-OS 11.1.10-h30",
"PAN-OS 11.1.10-h28",
"PAN-OS 11.1.10-h27",
"PAN-OS 11.1.10-h26",
"PAN-OS 11.1.10-h25",
"PAN-OS 11.1.10-h21",
"PAN-OS 11.1.10-h12",
"PAN-OS 11.1.10-h10",
"PAN-OS 11.1.10-h9",
"PAN-OS 11.1.10-h7",
"PAN-OS 11.1.10-h5",
"PAN-OS 11.1.10-h4",
"PAN-OS 11.1.10-h1",
"PAN-OS 11.1.10",
"PAN-OS 11.1.9",
"PAN-OS 11.1.8",
"PAN-OS 11.1.6-h36",
"PAN-OS 11.1.6-h35",
"PAN-OS 11.1.6-h34",
"PAN-OS 11.1.6-h33",
"PAN-OS 11.1.6-h32",
"PAN-OS 11.1.6-h29",
"PAN-OS 11.1.6-h25",
"PAN-OS 11.1.6-h23",
"PAN-OS 11.1.6-h22",
"PAN-OS 11.1.6-h21",
"PAN-OS 11.1.6-h20",
"PAN-OS 11.1.6-h19",
"PAN-OS 11.1.6-h18",
"PAN-OS 11.1.6-h17",
"PAN-OS 11.1.6-h14",
"PAN-OS 11.1.6-h10",
"PAN-OS 11.1.6-h7",
"PAN-OS 11.1.6-h6",
"PAN-OS 11.1.6-h4",
"PAN-OS 11.1.6-h3",
"PAN-OS 11.1.6-h2",
"PAN-OS 11.1.6-h1",
"PAN-OS 11.1.6",
"PAN-OS 11.1.5-h1",
"PAN-OS 11.1.5",
"PAN-OS 11.1.4-h35",
"PAN-OS 11.1.4-h34",
"PAN-OS 11.1.4-h33",
"PAN-OS 11.1.4-h32",
"PAN-OS 11.1.4-h27",
"PAN-OS 11.1.4-h25",
"PAN-OS 11.1.4-h18",
"PAN-OS 11.1.4-h17",
"PAN-OS 11.1.4-h15",
"PAN-OS 11.1.4-h13",
"PAN-OS 11.1.4-h12",
"PAN-OS 11.1.4-h11",
"PAN-OS 11.1.4-h10",
"PAN-OS 11.1.4-h9",
"PAN-OS 11.1.4-h8",
"PAN-OS 11.1.4-h7",
"PAN-OS 11.1.4-h6",
"PAN-OS 11.1.4-h5",
"PAN-OS 11.1.4-h4",
"PAN-OS 11.1.4-h3",
"PAN-OS 11.1.4-h2",
"PAN-OS 11.1.4-h1",
"PAN-OS 11.1.4",
"PAN-OS 11.1.3-h13",
"PAN-OS 11.1.3-h12",
"PAN-OS 11.1.3-h11",
"PAN-OS 11.1.3-h10",
"PAN-OS 11.1.3-h9",
"PAN-OS 11.1.3-h8",
"PAN-OS 11.1.3-h7",
"PAN-OS 11.1.3-h6",
"PAN-OS 11.1.3-h5",
"PAN-OS 11.1.3-h4",
"PAN-OS 11.1.3-h3",
"PAN-OS 11.1.3-h2",
"PAN-OS 11.1.3-h1",
"PAN-OS 11.1.3",
"PAN-OS 11.1.2-h18",
"PAN-OS 11.1.2-h17",
"PAN-OS 11.1.2-h16",
"PAN-OS 11.1.2-h15",
"PAN-OS 11.1.2-h14",
"PAN-OS 11.1.2-h13",
"PAN-OS 11.1.2-h12",
"PAN-OS 11.1.2-h11",
"PAN-OS 11.1.2-h10",
"PAN-OS 11.1.2-h9",
"PAN-OS 11.1.2-h8",
"PAN-OS 11.1.2-h7",
"PAN-OS 11.1.2-h6",
"PAN-OS 11.1.2-h5",
"PAN-OS 11.1.2-h4",
"PAN-OS 11.1.2-h3",
"PAN-OS 11.1.2-h2",
"PAN-OS 11.1.2-h1",
"PAN-OS 11.1.2",
"PAN-OS 11.1.1-h2",
"PAN-OS 11.1.1-h1",
"PAN-OS 11.1.1",
"PAN-OS 11.1.0-h4",
"PAN-OS 11.1.0-h3",
"PAN-OS 11.1.0-h2",
"PAN-OS 11.1.0-h1",
"PAN-OS 11.1.0",
"PAN-OS 10.2.18-h9",
"PAN-OS 10.2.18-h8",
"PAN-OS 10.2.18-h7",
"PAN-OS 10.2.18-h6",
"PAN-OS 10.2.18-h5",
"PAN-OS 10.2.18-h1",
"PAN-OS 10.2.18",
"PAN-OS 10.2.17",
"PAN-OS 10.2.16-h9",
"PAN-OS 10.2.16-h8",
"PAN-OS 10.2.16-h7",
"PAN-OS 10.2.16-h6",
"PAN-OS 10.2.16-h4",
"PAN-OS 10.2.16-h1",
"PAN-OS 10.2.16",
"PAN-OS 10.2.15",
"PAN-OS 10.2.14-h1",
"PAN-OS 10.2.14",
"PAN-OS 10.2.13-h23",
"PAN-OS 10.2.13-h22",
"PAN-OS 10.2.13-h21",
"PAN-OS 10.2.13-h18",
"PAN-OS 10.2.13-h16",
"PAN-OS 10.2.13-h15",
"PAN-OS 10.2.13-h10",
"PAN-OS 10.2.13-h7",
"PAN-OS 10.2.13-h5",
"PAN-OS 10.2.13-h4",
"PAN-OS 10.2.13-h3",
"PAN-OS 10.2.13-h2",
"PAN-OS 10.2.13-h1",
"PAN-OS 10.2.13",
"PAN-OS 10.2.12-h6",
"PAN-OS 10.2.12-h5",
"PAN-OS 10.2.12-h4",
"PAN-OS 10.2.12-h3",
"PAN-OS 10.2.12-h2",
"PAN-OS 10.2.12-h1",
"PAN-OS 10.2.12",
"PAN-OS 10.2.11-h13",
"PAN-OS 10.2.11-h12",
"PAN-OS 10.2.11-h11",
"PAN-OS 10.2.11-h10",
"PAN-OS 10.2.11-h9",
"PAN-OS 10.2.11-h8",
"PAN-OS 10.2.11-h7",
"PAN-OS 10.2.11-h6",
"PAN-OS 10.2.11-h5",
"PAN-OS 10.2.11-h4",
"PAN-OS 10.2.11-h3",
"PAN-OS 10.2.11-h2",
"PAN-OS 10.2.11-h1",
"PAN-OS 10.2.11",
"PAN-OS 10.2.10-h39",
"PAN-OS 10.2.10-h37",
"PAN-OS 10.2.10-h36",
"PAN-OS 10.2.10-h31",
"PAN-OS 10.2.10-h30",
"PAN-OS 10.2.10-h27",
"PAN-OS 10.2.10-h26",
"PAN-OS 10.2.10-h23",
"PAN-OS 10.2.10-h21",
"PAN-OS 10.2.10-h18",
"PAN-OS 10.2.10-h17",
"PAN-OS 10.2.10-h14",
"PAN-OS 10.2.10-h13",
"PAN-OS 10.2.10-h12",
"PAN-OS 10.2.10-h11",
"PAN-OS 10.2.10-h10",
"PAN-OS 10.2.10-h9",
"PAN-OS 10.2.10-h8",
"PAN-OS 10.2.10-h7",
"PAN-OS 10.2.10-h6",
"PAN-OS 10.2.10-h5",
"PAN-OS 10.2.10-h4",
"PAN-OS 10.2.10-h3",
"PAN-OS 10.2.10-h2",
"PAN-OS 10.2.10-h1",
"PAN-OS 10.2.10",
"PAN-OS 10.2.9-h21",
"PAN-OS 10.2.9-h20",
"PAN-OS 10.2.9-h19",
"PAN-OS 10.2.9-h18",
"PAN-OS 10.2.9-h17",
"PAN-OS 10.2.9-h16",
"PAN-OS 10.2.9-h15",
"PAN-OS 10.2.9-h14",
"PAN-OS 10.2.9-h13",
"PAN-OS 10.2.9-h12",
"PAN-OS 10.2.9-h11",
"PAN-OS 10.2.9-h10",
"PAN-OS 10.2.9-h9",
"PAN-OS 10.2.9-h8",
"PAN-OS 10.2.9-h7",
"PAN-OS 10.2.9-h6",
"PAN-OS 10.2.9-h5",
"PAN-OS 10.2.9-h4",
"PAN-OS 10.2.9-h3",
"PAN-OS 10.2.9-h2",
"PAN-OS 10.2.9-h1",
"PAN-OS 10.2.9",
"PAN-OS 10.2.8-h21",
"PAN-OS 10.2.8-h20",
"PAN-OS 10.2.8-h19",
"PAN-OS 10.2.8-h18",
"PAN-OS 10.2.8-h17",
"PAN-OS 10.2.8-h16",
"PAN-OS 10.2.8-h15",
"PAN-OS 10.2.8-h14",
"PAN-OS 10.2.8-h13",
"PAN-OS 10.2.8-h12",
"PAN-OS 10.2.8-h11",
"PAN-OS 10.2.8-h10",
"PAN-OS 10.2.8-h9",
"PAN-OS 10.2.8-h8",
"PAN-OS 10.2.8-h7",
"PAN-OS 10.2.8-h6",
"PAN-OS 10.2.8-h5",
"PAN-OS 10.2.8-h4",
"PAN-OS 10.2.8-h3",
"PAN-OS 10.2.8-h2",
"PAN-OS 10.2.8-h1",
"PAN-OS 10.2.8",
"PAN-OS 10.2.7-h36",
"PAN-OS 10.2.7-h35",
"PAN-OS 10.2.7-h34",
"PAN-OS 10.2.7-h32",
"PAN-OS 10.2.7-h24",
"PAN-OS 10.2.7-h23",
"PAN-OS 10.2.7-h22",
"PAN-OS 10.2.7-h21",
"PAN-OS 10.2.7-h20",
"PAN-OS 10.2.7-h19",
"PAN-OS 10.2.7-h18",
"PAN-OS 10.2.7-h17",
"PAN-OS 10.2.7-h16",
"PAN-OS 10.2.7-h15",
"PAN-OS 10.2.7-h14",
"PAN-OS 10.2.7-h13",
"PAN-OS 10.2.7-h12",
"PAN-OS 10.2.7-h11",
"PAN-OS 10.2.7-h10",
"PAN-OS 10.2.7-h9",
"PAN-OS 10.2.7-h8",
"PAN-OS 10.2.7-h7",
"PAN-OS 10.2.7-h6",
"PAN-OS 10.2.7-h5",
"PAN-OS 10.2.7-h4",
"PAN-OS 10.2.7-h3",
"PAN-OS 10.2.7-h2",
"PAN-OS 10.2.7-h1",
"PAN-OS 10.2.7",
"PAN-OS 10.2.6-h6",
"PAN-OS 10.2.6-h5",
"PAN-OS 10.2.6-h4",
"PAN-OS 10.2.6-h3",
"PAN-OS 10.2.6-h2",
"PAN-OS 10.2.6-h1",
"PAN-OS 10.2.6",
"PAN-OS 10.2.5-h9",
"PAN-OS 10.2.5-h8",
"PAN-OS 10.2.5-h7",
"PAN-OS 10.2.5-h6",
"PAN-OS 10.2.5-h5",
"PAN-OS 10.2.5-h4",
"PAN-OS 10.2.5-h3",
"PAN-OS 10.2.5-h2",
"PAN-OS 10.2.5-h1",
"PAN-OS 10.2.5",
"PAN-OS 10.2.4-h32",
"PAN-OS 10.2.4-h31",
"PAN-OS 10.2.4-h30",
"PAN-OS 10.2.4-h29",
"PAN-OS 10.2.4-h28",
"PAN-OS 10.2.4-h27",
"PAN-OS 10.2.4-h26",
"PAN-OS 10.2.4-h25",
"PAN-OS 10.2.4-h24",
"PAN-OS 10.2.4-h23",
"PAN-OS 10.2.4-h22",
"PAN-OS 10.2.4-h21",
"PAN-OS 10.2.4-h20",
"PAN-OS 10.2.4-h19",
"PAN-OS 10.2.4-h18",
"PAN-OS 10.2.4-h17",
"PAN-OS 10.2.4-h16",
"PAN-OS 10.2.4-h15",
"PAN-OS 10.2.4-h14",
"PAN-OS 10.2.4-h13",
"PAN-OS 10.2.4-h12",
"PAN-OS 10.2.4-h11",
"PAN-OS 10.2.4-h10",
"PAN-OS 10.2.4-h9",
"PAN-OS 10.2.4-h8",
"PAN-OS 10.2.4-h7",
"PAN-OS 10.2.4-h6",
"PAN-OS 10.2.4-h5",
"PAN-OS 10.2.4-h4",
"PAN-OS 10.2.4-h3",
"PAN-OS 10.2.4-h2",
"PAN-OS 10.2.4-h1",
"PAN-OS 10.2.4",
"PAN-OS 10.2.3-h14",
"PAN-OS 10.2.3-h13",
"PAN-OS 10.2.3-h12",
"PAN-OS 10.2.3-h11",
"PAN-OS 10.2.3-h10",
"PAN-OS 10.2.3-h9",
"PAN-OS 10.2.3-h8",
"PAN-OS 10.2.3-h7",
"PAN-OS 10.2.3-h6",
"PAN-OS 10.2.3-h5",
"PAN-OS 10.2.3-h4",
"PAN-OS 10.2.3-h3",
"PAN-OS 10.2.3-h2",
"PAN-OS 10.2.3-h1",
"PAN-OS 10.2.3",
"PAN-OS 10.2.2-h6",
"PAN-OS 10.2.2-h5",
"PAN-OS 10.2.2-h4",
"PAN-OS 10.2.2-h3",
"PAN-OS 10.2.2-h2",
"PAN-OS 10.2.2-h1",
"PAN-OS 10.2.2",
"PAN-OS 10.2.1-h3",
"PAN-OS 10.2.1-h2",
"PAN-OS 10.2.1-h1",
"PAN-OS 10.2.1",
"PAN-OS 10.2.0-h4",
"PAN-OS 10.2.0-h3",
"PAN-OS 10.2.0-h2",
"PAN-OS 10.2.0-h1",
"PAN-OS 10.2.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0309",
"datePublished": "2026-09-10T05:44:10.148Z",
"dateReserved": "2025-11-03T20:45:08.103Z",
"dateUpdated": "2026-09-11T03:56:05.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0310 (GCVE-0-2026-0310)
Vulnerability from cvelistv5 – Published: 2026-09-10 05:21 – Updated: 2026-09-11 03:56
VLAI
EPSS
VEX
Title
PAN-OS: Buffer Overflow Vulnerability via XML Processing
Summary
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls.
The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
Panorama is impacted by this vulnerability.
Severity
7.2 (High)
6.6 (Medium)
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 00:00 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.paloaltonetworks.com/CVE-2026-0310 | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW |
Affected:
All
(custom)
cpe:2.3:o:palo_alto_networks:cloud_ngfw:*:*:*:*:*:AWS:*:* cpe:2.3:o:palo_alto_networks:cloud_ngfw:*:*:*:*:*:Azure:*:* |
|
| Palo Alto Networks | PAN-OS |
Affected:
12.2.0 , < 12.2.3
(custom)
Affected: 12.1.0 , < 12.1.4-h10 (custom) Affected: 11.2.0 , < 11.2.4-h21 (custom) Affected: 11.1.0 , < 11.1.4-h36 (custom) Affected: 10.2.0 , < 10.2.7-h37 (custom) cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h30:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h28:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h26:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h33:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h29:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h33:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h25:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.17:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h39:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h37:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h31:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h30:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h36:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h35:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h34:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h32:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h24:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h23:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h22:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h21:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h20:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h19:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h18:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h17:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h16:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h15:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h14:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h13:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h12:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h11:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h10:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h9:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h8:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h7:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h6:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h5:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h4:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h3:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h2:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h1:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:-:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:* |
|
| Palo Alto Networks | Prisma Access |
Unaffected:
12.1.0 , < 12.1.4-h10
(custom)
Affected: 11.2.0 , < 11.2.4-h21 (custom) Affected: 10.2.0 , < 10.2.7-h37 (custom) cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:* cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:* |
Date Public
2026-09-09 16:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0310",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:56:06.683Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"AWS",
"Azure"
],
"product": "Cloud NGFW",
"vendor": "Palo Alto Networks",
"versions": [
{
"status": "affected",
"version": "All",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h30:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h28:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h26:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h33:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h29:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h33:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h25:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.18:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.17:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.16:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.15:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.14:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.13:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.12:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.11:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h39:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h37:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h31:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h30:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h27:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h26:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.10:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.9:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.8:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h36:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h35:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h34:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h32:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h24:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h23:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h22:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h21:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h20:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h19:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h18:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h17:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h16:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h15:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h14:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h13:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h12:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h11:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h10:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h9:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h8:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h7:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h6:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h5:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h4:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h3:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h2:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:h1:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.7:-:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.6:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.5:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.4:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.3:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.2:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.1:*:*:*:*:*:*:*",
"cpe:2.3:o:palo_alto_networks:pan-os:10.2.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "PAN-OS",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.2.3",
"status": "unaffected"
}
],
"lessThan": "12.2.3",
"status": "affected",
"version": "12.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "12.1.10",
"status": "unaffected"
},
{
"at": "12.1.7-h5",
"status": "unaffected"
},
{
"at": "12.1.4-h10",
"status": "unaffected"
}
],
"lessThan": "12.1.4-h10",
"status": "affected",
"version": "12.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.2.13-h2",
"status": "unaffected"
},
{
"at": "11.2.10-h14",
"status": "unaffected"
},
{
"at": "11.2.7-h20",
"status": "unaffected"
},
{
"at": "11.2.4-h21",
"status": "unaffected"
}
],
"lessThan": "11.2.4-h21",
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.1.16-h2",
"status": "unaffected"
},
{
"at": "11.1.13-h12",
"status": "unaffected"
},
{
"at": "11.1.10-h33",
"status": "unaffected"
},
{
"at": "11.1.7-h10",
"status": "unaffected"
},
{
"at": "11.1.6-h38",
"status": "unaffected"
},
{
"at": "11.1.4-h36",
"status": "unaffected"
}
],
"lessThan": "11.1.4-h36",
"status": "affected",
"version": "11.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "10.2.18-h10",
"status": "unaffected"
},
{
"at": "10.2.16-h10",
"status": "unaffected"
},
{
"at": "10.2.13-h24",
"status": "unaffected"
},
{
"at": "10.2.10-h40",
"status": "unaffected"
},
{
"at": "10.2.7-h37",
"status": "unaffected"
}
],
"lessThan": "10.2.7-h37",
"status": "affected",
"version": "10.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Prisma Access",
"vendor": "Palo Alto Networks",
"versions": [
{
"changes": [
{
"at": "12.1.7-h5",
"status": "unaffected"
}
],
"lessThan": "12.1.4-h10",
"status": "unaffected",
"version": "12.1.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "11.2.7-h20",
"status": "unaffected"
}
],
"lessThan": "11.2.4-h21",
"status": "affected",
"version": "11.2.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "10.2.10-h40",
"status": "unaffected"
}
],
"lessThan": "10.2.7-h37",
"status": "affected",
"version": "10.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No special configuration is required to be affected by this issue."
}
],
"value": "No special configuration is required to be affected by this issue."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:cloud_ngfw:*:*:*:*:*:AWS:*:*",
"versionStartIncluding": "all",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:cloud_ngfw:*:*:*:*:*:Azure:*:*",
"versionStartIncluding": "all",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.2.3",
"versionStartIncluding": "12.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.10",
"versionStartIncluding": "12.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.7-h5",
"versionStartIncluding": "12.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "12.1.4-h10",
"versionStartIncluding": "12.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.13-h2",
"versionStartIncluding": "11.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.10-h14",
"versionStartIncluding": "11.2.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.7-h20",
"versionStartIncluding": "11.2.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.4-h21",
"versionStartIncluding": "11.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.16-h2",
"versionStartIncluding": "11.1.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.13-h12",
"versionStartIncluding": "11.1.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.10-h33",
"versionStartIncluding": "11.1.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.7-h10",
"versionStartIncluding": "11.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.6-h38",
"versionStartIncluding": "11.1.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.1.4-h36",
"versionStartIncluding": "11.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.18-h10",
"versionStartIncluding": "10.2.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.16-h10",
"versionStartIncluding": "10.2.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.13-h24",
"versionStartIncluding": "10.2.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.10-h40",
"versionStartIncluding": "10.2.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.7-h37",
"versionStartIncluding": "10.2.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*",
"versionEndExcluding": "11.2.7-h20",
"versionStartIncluding": "11.2.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.2.10-h40",
"versionStartIncluding": "10.2.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "other",
"value": "Palo Alto Networks thanks our internal security research teams for discovering and reporting this issue."
}
],
"datePublic": "2026-09-09T16:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cspan\u003eA buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS\u00ae software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls.\u003c/span\u003e\u003cb\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/b\u003e\u003cspan\u003eThe security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended\u003c/span\u003e \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431\"\u003e\u003cspan\u003ebest practice deployment guidelines\u003c/span\u003e\u003c/a\u003e\u003cspan\u003e. \u003c/span\u003e\u003cb\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/b\u003e\u003cspan\u003ePanorama is impacted by this vulnerability.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS\u00ae software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls.\n\nThe security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . \n\nPanorama is impacted by this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"value": "Palo Alto Networks is not aware of any malicious exploitation of this issue."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "The risk is highest for PA-Series hardware firewalls as there is a risk of arbitrary code execution"
}
]
},
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "The risk is lower for VM-Series firewalls, as the impact is limited to a Denial of Service condition"
}
]
},
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "The risk of exploitation is lower for Prisma Access and Cloud NGFW as it requires an authenticated user and the external network access is restricted."
}
]
},
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface."
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T05:21:28.646Z",
"orgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"shortName": "palo_alto"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.paloaltonetworks.com/CVE-2026-0310"
}
],
"solutions": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003ctable class=\"tbl\"\u003e\u003cthead\u003e\u003ctr\u003e\u003cth\u003eVersion\u003cbr\u003e\u003c/th\u003e\u003cth\u003eMinor Version\u003cbr\u003e\u003c/th\u003e\u003cth\u003eSuggested Solution\u003cbr\u003e\u003c/th\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eCloud NGFW\u0026nbsp;\u003c/td\u003e\u003ctd\u003e\u003c/td\u003e\u003ctd\u003eCustomers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 12.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e12.2.0 through 12.2.2\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.2.3 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 12.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.8 through 12.1.9\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.5 through 12.1.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.7-h5 or 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e12.1.2 through 12.1.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 12.1.4-h10 or 12.1.10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.2\u003c/td\u003e\n \u003ctd\u003e11.2.11 through 11.2.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.13-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.8 through 11.2.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.10-h14 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.5 through 11.2.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.7-h20 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.0 through 11.2.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.4-h21 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 11.1\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.14 through 11.1.16-h*\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.16-h2 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.11 through 11.1.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.13-h12 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.8 through 11.1.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.10-h33 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.7 through 11.1.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.7-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.5 through 11.1.6-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.6-h38 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e11.1.0 through 11.1.4-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.1.4-h36 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePAN-OS 10.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.17 through \u003cbr\u003e10.2.18-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.18-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.14 through 10.2.16-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.16-h10 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.11 through 10.2.13-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.13-h24 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.8 through 10.2.10-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.10-h40 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.0 through 10.2.7-h*\u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.7-h37 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eAll older\u003cbr\u003eunsupported\u003cbr\u003ePAN-OS versions\u003c/td\u003e\u003ctd\u003e\u0026nbsp;\u003c/td\u003e\u003ctd\u003eUpgrade to a supported fixed version.\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ePrisma Access 12.1\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e12.1.2 through 12.1.*\u003c/td\u003e\u003ctd\u003e\u003cbr\u003eUpgrade to 12.1.7-h5 or later.\u003cbr\u003e\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Access 11.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e11.2.0 through 11.2*\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003eUpgrade to 11.2.7-h20 or later.\u003c/td\u003e\n \u003c/tr\u003e\u003ctr\u003e\n \u003ctd\u003ePrisma Access 10.2\u003cbr\u003e\u003c/td\u003e\n \u003ctd\u003e10.2.0 through 10.2.*\u003cbr\u003e \u003c/td\u003e\n \u003ctd\u003eUpgrade to 10.2.10-h40 or later.\u003cbr\u003e\u003c/td\u003e\n \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003cbr\u003e* See the note under Product Status for information regarding Prisma Access and Cloud NGFW upgrades."
}
],
"value": "VERSION MINOR VERSION SUGGESTED SOLUTION\nCloud NGFW\u00a0 Customers who prefer to upgrade can work with Palo Alto\n Networks support to schedule an on-demand software upgrade.\nPAN-OS 12.2 12.2.0 through 12.2.2 Upgrade to 12.2.3 or later.\nPAN-OS 12.1 12.1.8 through 12.1.9 Upgrade to 12.1.10 or later.\n 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h5 or 12.1.10 or later.\n 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h10 or 12.1.10 or later.\nPAN-OS 11.2 11.2.11 through 11.2.13-h* Upgrade to 11.2.13-h2 or later.\n 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h14 or later.\n 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h20 or later.\n 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h21 or later.\nPAN-OS 11.1 11.1.14 through 11.1.16-h* Upgrade to 11.1.16-h2 or later.\n 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h12 or later.\n 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h33 or later.\n 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h10 or later.\n 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h38 or later.\n 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h36 or later.\nPAN-OS 10.2 10.2.17 through Upgrade to 10.2.18-h10 or later.\n 10.2.18-h*\n 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h10 or later.\n 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h24 or later.\n 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h40 or later.\n 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h37 or later.\nAll older \u00a0 Upgrade to a supported fixed version.\nunsupported\nPAN-OS versions\nPrisma Access 12.1 12.1.2 through 12.1.* Upgrade to 12.1.7-h5 or later.\nPrisma Access 11.2 11.2.0 through 11.2* Upgrade to 11.2.7-h20 or later.\nPrisma Access 10.2 10.2.0 through 10.2.* Upgrade to 10.2.10-h40 or later.\n\n\n* See the note under Product Status for information regarding Prisma Access and Cloud NGFW upgrades."
}
],
"source": {
"discovery": "INTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-09-09T16:00:00.000Z",
"value": "Initial Publication"
}
],
"title": "PAN-OS: Buffer Overflow Vulnerability via XML Processing",
"workarounds": [
{
"lang": "eng",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No known workarounds exist for this issue."
}
],
"value": "No known workarounds exist for this issue."
}
],
"x_affectedList": [
"PAN-OS 12.2.2",
"PAN-OS 12.1.9",
"PAN-OS 12.1.8",
"PAN-OS 12.1.7-h3",
"PAN-OS 12.1.7-h2",
"PAN-OS 12.1.7-h1",
"PAN-OS 12.1.7",
"PAN-OS 12.1.6",
"PAN-OS 12.1.5",
"PAN-OS 12.1.4-h9",
"PAN-OS 12.1.4-h8",
"PAN-OS 12.1.4-h7",
"PAN-OS 12.1.4-h6",
"PAN-OS 12.1.4-h5",
"PAN-OS 12.1.4-h3",
"PAN-OS 12.1.4-h2",
"PAN-OS 12.1.4",
"PAN-OS 12.1.3-h3",
"PAN-OS 12.1.3-h1",
"PAN-OS 12.1.3",
"PAN-OS 12.1.2",
"PAN-OS 11.2.13-h1",
"PAN-OS 11.2.13",
"PAN-OS 11.2.12",
"PAN-OS 11.2.11",
"PAN-OS 11.2.10-h13",
"PAN-OS 11.2.10-h12",
"PAN-OS 11.2.10-h10",
"PAN-OS 11.2.10-h9",
"PAN-OS 11.2.10-h8",
"PAN-OS 11.2.10-h7",
"PAN-OS 11.2.10-h6",
"PAN-OS 11.2.10-h5",
"PAN-OS 11.2.10-h4",
"PAN-OS 11.2.10-h3",
"PAN-OS 11.2.10-h2",
"PAN-OS 11.2.10-h1",
"PAN-OS 11.2.10",
"PAN-OS 11.2.9",
"PAN-OS 11.2.8",
"PAN-OS 11.2.7-h19",
"PAN-OS 11.2.7-h18",
"PAN-OS 11.2.7-h17",
"PAN-OS 11.2.7-h16",
"PAN-OS 11.2.7-h15",
"PAN-OS 11.2.7-h14",
"PAN-OS 11.2.7-h13",
"PAN-OS 11.2.7-h12",
"PAN-OS 11.2.7-h11",
"PAN-OS 11.2.7-h10",
"PAN-OS 11.2.7-h8",
"PAN-OS 11.2.7-h7",
"PAN-OS 11.2.7-h4",
"PAN-OS 11.2.7-h3",
"PAN-OS 11.2.7-h2",
"PAN-OS 11.2.7-h1",
"PAN-OS 11.2.7",
"PAN-OS 11.2.6",
"PAN-OS 11.2.5",
"PAN-OS 11.2.4-h20",
"PAN-OS 11.2.4-h18",
"PAN-OS 11.2.4-h17",
"PAN-OS 11.2.4-h15",
"PAN-OS 11.2.4-h14",
"PAN-OS 11.2.4-h12",
"PAN-OS 11.2.4-h11",
"PAN-OS 11.2.4-h10",
"PAN-OS 11.2.4-h9",
"PAN-OS 11.2.4-h8",
"PAN-OS 11.2.4-h7",
"PAN-OS 11.2.4-h6",
"PAN-OS 11.2.4-h5",
"PAN-OS 11.2.4-h4",
"PAN-OS 11.2.4-h3",
"PAN-OS 11.2.4-h2",
"PAN-OS 11.2.4-h1",
"PAN-OS 11.2.4",
"PAN-OS 11.2.3-h5",
"PAN-OS 11.2.3-h4",
"PAN-OS 11.2.3-h3",
"PAN-OS 11.2.3-h2",
"PAN-OS 11.2.3-h1",
"PAN-OS 11.2.3",
"PAN-OS 11.2.2-h2",
"PAN-OS 11.2.2-h1",
"PAN-OS 11.2.1-h1",
"PAN-OS 11.2.1",
"PAN-OS 11.2.0-h1",
"PAN-OS 11.2.0",
"PAN-OS 11.1.16-h1",
"PAN-OS 11.1.16",
"PAN-OS 11.1.15",
"PAN-OS 11.1.14",
"PAN-OS 11.1.13-h11",
"PAN-OS 11.1.13-h10",
"PAN-OS 11.1.13-h9",
"PAN-OS 11.1.13-h8",
"PAN-OS 11.1.13-h7",
"PAN-OS 11.1.13-h6",
"PAN-OS 11.1.13-h5",
"PAN-OS 11.1.13-h3",
"PAN-OS 11.1.13-h2",
"PAN-OS 11.1.13-h1",
"PAN-OS 11.1.13",
"PAN-OS 11.1.12",
"PAN-OS 11.1.11",
"PAN-OS 11.1.10-h32",
"PAN-OS 11.1.10-h30",
"PAN-OS 11.1.10-h28",
"PAN-OS 11.1.10-h27",
"PAN-OS 11.1.10-h26",
"PAN-OS 11.1.10-h25",
"PAN-OS 11.1.10-h21",
"PAN-OS 11.1.10-h12",
"PAN-OS 11.1.10-h10",
"PAN-OS 11.1.10-h9",
"PAN-OS 11.1.10-h7",
"PAN-OS 11.1.10-h5",
"PAN-OS 11.1.10-h4",
"PAN-OS 11.1.10-h1",
"PAN-OS 11.1.10",
"PAN-OS 11.1.9",
"PAN-OS 11.1.8",
"PAN-OS 11.1.6-h36",
"PAN-OS 11.1.6-h35",
"PAN-OS 11.1.6-h34",
"PAN-OS 11.1.6-h33",
"PAN-OS 11.1.6-h32",
"PAN-OS 11.1.6-h29",
"PAN-OS 11.1.6-h25",
"PAN-OS 11.1.6-h23",
"PAN-OS 11.1.6-h22",
"PAN-OS 11.1.6-h21",
"PAN-OS 11.1.6-h20",
"PAN-OS 11.1.6-h19",
"PAN-OS 11.1.6-h18",
"PAN-OS 11.1.6-h17",
"PAN-OS 11.1.6-h14",
"PAN-OS 11.1.6-h10",
"PAN-OS 11.1.6-h7",
"PAN-OS 11.1.6-h6",
"PAN-OS 11.1.6-h4",
"PAN-OS 11.1.6-h3",
"PAN-OS 11.1.6-h2",
"PAN-OS 11.1.6-h1",
"PAN-OS 11.1.6",
"PAN-OS 11.1.5-h1",
"PAN-OS 11.1.5",
"PAN-OS 11.1.4-h35",
"PAN-OS 11.1.4-h34",
"PAN-OS 11.1.4-h33",
"PAN-OS 11.1.4-h32",
"PAN-OS 11.1.4-h27",
"PAN-OS 11.1.4-h25",
"PAN-OS 11.1.4-h18",
"PAN-OS 11.1.4-h17",
"PAN-OS 11.1.4-h15",
"PAN-OS 11.1.4-h13",
"PAN-OS 11.1.4-h12",
"PAN-OS 11.1.4-h11",
"PAN-OS 11.1.4-h10",
"PAN-OS 11.1.4-h9",
"PAN-OS 11.1.4-h8",
"PAN-OS 11.1.4-h7",
"PAN-OS 11.1.4-h6",
"PAN-OS 11.1.4-h5",
"PAN-OS 11.1.4-h4",
"PAN-OS 11.1.4-h3",
"PAN-OS 11.1.4-h2",
"PAN-OS 11.1.4-h1",
"PAN-OS 11.1.4",
"PAN-OS 11.1.3-h13",
"PAN-OS 11.1.3-h12",
"PAN-OS 11.1.3-h11",
"PAN-OS 11.1.3-h10",
"PAN-OS 11.1.3-h9",
"PAN-OS 11.1.3-h8",
"PAN-OS 11.1.3-h7",
"PAN-OS 11.1.3-h6",
"PAN-OS 11.1.3-h5",
"PAN-OS 11.1.3-h4",
"PAN-OS 11.1.3-h3",
"PAN-OS 11.1.3-h2",
"PAN-OS 11.1.3-h1",
"PAN-OS 11.1.3",
"PAN-OS 11.1.2-h18",
"PAN-OS 11.1.2-h17",
"PAN-OS 11.1.2-h16",
"PAN-OS 11.1.2-h15",
"PAN-OS 11.1.2-h14",
"PAN-OS 11.1.2-h13",
"PAN-OS 11.1.2-h12",
"PAN-OS 11.1.2-h11",
"PAN-OS 11.1.2-h10",
"PAN-OS 11.1.2-h9",
"PAN-OS 11.1.2-h8",
"PAN-OS 11.1.2-h7",
"PAN-OS 11.1.2-h6",
"PAN-OS 11.1.2-h5",
"PAN-OS 11.1.2-h4",
"PAN-OS 11.1.2-h3",
"PAN-OS 11.1.2-h2",
"PAN-OS 11.1.2-h1",
"PAN-OS 11.1.2",
"PAN-OS 11.1.1-h2",
"PAN-OS 11.1.1-h1",
"PAN-OS 11.1.1",
"PAN-OS 11.1.0-h4",
"PAN-OS 11.1.0-h3",
"PAN-OS 11.1.0-h2",
"PAN-OS 11.1.0-h1",
"PAN-OS 11.1.0",
"PAN-OS 10.2.18-h9",
"PAN-OS 10.2.18-h8",
"PAN-OS 10.2.18-h7",
"PAN-OS 10.2.18-h6",
"PAN-OS 10.2.18-h5",
"PAN-OS 10.2.18-h1",
"PAN-OS 10.2.18",
"PAN-OS 10.2.17",
"PAN-OS 10.2.16-h9",
"PAN-OS 10.2.16-h8",
"PAN-OS 10.2.16-h7",
"PAN-OS 10.2.16-h6",
"PAN-OS 10.2.16-h4",
"PAN-OS 10.2.16-h1",
"PAN-OS 10.2.16",
"PAN-OS 10.2.15",
"PAN-OS 10.2.14-h1",
"PAN-OS 10.2.14",
"PAN-OS 10.2.13-h23",
"PAN-OS 10.2.13-h22",
"PAN-OS 10.2.13-h21",
"PAN-OS 10.2.13-h18",
"PAN-OS 10.2.13-h16",
"PAN-OS 10.2.13-h15",
"PAN-OS 10.2.13-h10",
"PAN-OS 10.2.13-h7",
"PAN-OS 10.2.13-h5",
"PAN-OS 10.2.13-h4",
"PAN-OS 10.2.13-h3",
"PAN-OS 10.2.13-h2",
"PAN-OS 10.2.13-h1",
"PAN-OS 10.2.13",
"PAN-OS 10.2.12-h6",
"PAN-OS 10.2.12-h5",
"PAN-OS 10.2.12-h4",
"PAN-OS 10.2.12-h3",
"PAN-OS 10.2.12-h2",
"PAN-OS 10.2.12-h1",
"PAN-OS 10.2.12",
"PAN-OS 10.2.11-h13",
"PAN-OS 10.2.11-h12",
"PAN-OS 10.2.11-h11",
"PAN-OS 10.2.11-h10",
"PAN-OS 10.2.11-h9",
"PAN-OS 10.2.11-h8",
"PAN-OS 10.2.11-h7",
"PAN-OS 10.2.11-h6",
"PAN-OS 10.2.11-h5",
"PAN-OS 10.2.11-h4",
"PAN-OS 10.2.11-h3",
"PAN-OS 10.2.11-h2",
"PAN-OS 10.2.11-h1",
"PAN-OS 10.2.11",
"PAN-OS 10.2.10-h39",
"PAN-OS 10.2.10-h37",
"PAN-OS 10.2.10-h36",
"PAN-OS 10.2.10-h31",
"PAN-OS 10.2.10-h30",
"PAN-OS 10.2.10-h27",
"PAN-OS 10.2.10-h26",
"PAN-OS 10.2.10-h23",
"PAN-OS 10.2.10-h21",
"PAN-OS 10.2.10-h18",
"PAN-OS 10.2.10-h17",
"PAN-OS 10.2.10-h14",
"PAN-OS 10.2.10-h13",
"PAN-OS 10.2.10-h12",
"PAN-OS 10.2.10-h11",
"PAN-OS 10.2.10-h10",
"PAN-OS 10.2.10-h9",
"PAN-OS 10.2.10-h8",
"PAN-OS 10.2.10-h7",
"PAN-OS 10.2.10-h6",
"PAN-OS 10.2.10-h5",
"PAN-OS 10.2.10-h4",
"PAN-OS 10.2.10-h3",
"PAN-OS 10.2.10-h2",
"PAN-OS 10.2.10-h1",
"PAN-OS 10.2.10",
"PAN-OS 10.2.9-h21",
"PAN-OS 10.2.9-h20",
"PAN-OS 10.2.9-h19",
"PAN-OS 10.2.9-h18",
"PAN-OS 10.2.9-h17",
"PAN-OS 10.2.9-h16",
"PAN-OS 10.2.9-h15",
"PAN-OS 10.2.9-h14",
"PAN-OS 10.2.9-h13",
"PAN-OS 10.2.9-h12",
"PAN-OS 10.2.9-h11",
"PAN-OS 10.2.9-h10",
"PAN-OS 10.2.9-h9",
"PAN-OS 10.2.9-h8",
"PAN-OS 10.2.9-h7",
"PAN-OS 10.2.9-h6",
"PAN-OS 10.2.9-h5",
"PAN-OS 10.2.9-h4",
"PAN-OS 10.2.9-h3",
"PAN-OS 10.2.9-h2",
"PAN-OS 10.2.9-h1",
"PAN-OS 10.2.9",
"PAN-OS 10.2.8-h21",
"PAN-OS 10.2.8-h20",
"PAN-OS 10.2.8-h19",
"PAN-OS 10.2.8-h18",
"PAN-OS 10.2.8-h17",
"PAN-OS 10.2.8-h16",
"PAN-OS 10.2.8-h15",
"PAN-OS 10.2.8-h14",
"PAN-OS 10.2.8-h13",
"PAN-OS 10.2.8-h12",
"PAN-OS 10.2.8-h11",
"PAN-OS 10.2.8-h10",
"PAN-OS 10.2.8-h9",
"PAN-OS 10.2.8-h8",
"PAN-OS 10.2.8-h7",
"PAN-OS 10.2.8-h6",
"PAN-OS 10.2.8-h5",
"PAN-OS 10.2.8-h4",
"PAN-OS 10.2.8-h3",
"PAN-OS 10.2.8-h2",
"PAN-OS 10.2.8-h1",
"PAN-OS 10.2.8",
"PAN-OS 10.2.7-h36",
"PAN-OS 10.2.7-h35",
"PAN-OS 10.2.7-h34",
"PAN-OS 10.2.7-h32",
"PAN-OS 10.2.7-h24",
"PAN-OS 10.2.7-h23",
"PAN-OS 10.2.7-h22",
"PAN-OS 10.2.7-h21",
"PAN-OS 10.2.7-h20",
"PAN-OS 10.2.7-h19",
"PAN-OS 10.2.7-h18",
"PAN-OS 10.2.7-h17",
"PAN-OS 10.2.7-h16",
"PAN-OS 10.2.7-h15",
"PAN-OS 10.2.7-h14",
"PAN-OS 10.2.7-h13",
"PAN-OS 10.2.7-h12",
"PAN-OS 10.2.7-h11",
"PAN-OS 10.2.7-h10",
"PAN-OS 10.2.7-h9",
"PAN-OS 10.2.7-h8",
"PAN-OS 10.2.7-h7",
"PAN-OS 10.2.7-h6",
"PAN-OS 10.2.7-h5",
"PAN-OS 10.2.7-h4",
"PAN-OS 10.2.7-h3",
"PAN-OS 10.2.7-h2",
"PAN-OS 10.2.7-h1",
"PAN-OS 10.2.7",
"PAN-OS 10.2.6-h6",
"PAN-OS 10.2.6-h5",
"PAN-OS 10.2.6-h4",
"PAN-OS 10.2.6-h3",
"PAN-OS 10.2.6-h2",
"PAN-OS 10.2.6-h1",
"PAN-OS 10.2.6",
"PAN-OS 10.2.5-h9",
"PAN-OS 10.2.5-h8",
"PAN-OS 10.2.5-h7",
"PAN-OS 10.2.5-h6",
"PAN-OS 10.2.5-h5",
"PAN-OS 10.2.5-h4",
"PAN-OS 10.2.5-h3",
"PAN-OS 10.2.5-h2",
"PAN-OS 10.2.5-h1",
"PAN-OS 10.2.5",
"PAN-OS 10.2.4-h32",
"PAN-OS 10.2.4-h31",
"PAN-OS 10.2.4-h30",
"PAN-OS 10.2.4-h29",
"PAN-OS 10.2.4-h28",
"PAN-OS 10.2.4-h27",
"PAN-OS 10.2.4-h26",
"PAN-OS 10.2.4-h25",
"PAN-OS 10.2.4-h24",
"PAN-OS 10.2.4-h23",
"PAN-OS 10.2.4-h22",
"PAN-OS 10.2.4-h21",
"PAN-OS 10.2.4-h20",
"PAN-OS 10.2.4-h19",
"PAN-OS 10.2.4-h18",
"PAN-OS 10.2.4-h17",
"PAN-OS 10.2.4-h16",
"PAN-OS 10.2.4-h15",
"PAN-OS 10.2.4-h14",
"PAN-OS 10.2.4-h13",
"PAN-OS 10.2.4-h12",
"PAN-OS 10.2.4-h11",
"PAN-OS 10.2.4-h10",
"PAN-OS 10.2.4-h9",
"PAN-OS 10.2.4-h8",
"PAN-OS 10.2.4-h7",
"PAN-OS 10.2.4-h6",
"PAN-OS 10.2.4-h5",
"PAN-OS 10.2.4-h4",
"PAN-OS 10.2.4-h3",
"PAN-OS 10.2.4-h2",
"PAN-OS 10.2.4-h1",
"PAN-OS 10.2.4",
"PAN-OS 10.2.3-h14",
"PAN-OS 10.2.3-h13",
"PAN-OS 10.2.3-h12",
"PAN-OS 10.2.3-h11",
"PAN-OS 10.2.3-h10",
"PAN-OS 10.2.3-h9",
"PAN-OS 10.2.3-h8",
"PAN-OS 10.2.3-h7",
"PAN-OS 10.2.3-h6",
"PAN-OS 10.2.3-h5",
"PAN-OS 10.2.3-h4",
"PAN-OS 10.2.3-h3",
"PAN-OS 10.2.3-h2",
"PAN-OS 10.2.3-h1",
"PAN-OS 10.2.3",
"PAN-OS 10.2.2-h6",
"PAN-OS 10.2.2-h5",
"PAN-OS 10.2.2-h4",
"PAN-OS 10.2.2-h3",
"PAN-OS 10.2.2-h2",
"PAN-OS 10.2.2-h1",
"PAN-OS 10.2.2",
"PAN-OS 10.2.1-h3",
"PAN-OS 10.2.1-h2",
"PAN-OS 10.2.1-h1",
"PAN-OS 10.2.1",
"PAN-OS 10.2.0-h4",
"PAN-OS 10.2.0-h3",
"PAN-OS 10.2.0-h2",
"PAN-OS 10.2.0-h1",
"PAN-OS 10.2.0"
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "d6c1279f-00f6-4ef7-9217-f89ffe703ec0",
"assignerShortName": "palo_alto",
"cveId": "CVE-2026-0310",
"datePublished": "2026-09-10T05:21:28.646Z",
"dateReserved": "2025-11-03T20:45:08.930Z",
"dateUpdated": "2026-09-11T03:56:06.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2026-AVI-1156
Vulnerability from certfr_avis - Published: 2026-09-10 - Updated: 2026-09-10
De multiples vulnérabilités ont été découvertes dans les produits Palo Alto Networks. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une injection de code indirecte à distance (XSS).
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Palo Alto Networks | GlobalProtect App | GlobalProtect App versions 6.3 antérieures à 6.3.3-h15 | ||
| Palo Alto Networks | PAN-OS | PAN-OS versions 12.1.x antérieures à 12.1.10 | ||
| Palo Alto Networks | GlobalProtect App | GlobalProtect App toutes versions pour Android | ||
| Palo Alto Networks | Prisma Access | Prisma Access versions antérieures à 11.2.0 sans les derniers correctifs de sécurité | ||
| Palo Alto Networks | Prisma Access | Prisma Access versions antérieures à 10.2.0 sans les derniers correctifs de sécurité | ||
| Palo Alto Networks | Checkov by Prisma Cloud | Checkov by Prisma Cloud versions 3.2.x antérieures à 3.2.532 | ||
| Palo Alto Networks | PAN-OS | PAN-OS versions 11.1.4-hx antérieures à 11.1.4-h36 | ||
| Palo Alto Networks | PAN-OS | PAN-OS versions 12.2.x antérieures à 12.2.3 | ||
| Palo Alto Networks | PAN-OS | PAN-OS versions antérieures à 10.2.7-h37 | ||
| Palo Alto Networks | GlobalProtect App | GlobalProtect App versions 6.0 antérieures à 6.0.15 | ||
| Palo Alto Networks | Cloud NGFW | Cloud NGFW toutes versions | ||
| Palo Alto Networks | PAN-OS | PAN-OS versions 11.2.13-hx antérieures à 11.2.13-h2 | ||
| Palo Alto Networks | Cortex XDR Broker | Cortex XDR Broker versions antérieures à 32.0.52 | ||
| Palo Alto Networks | Prisma Access | Prisma Access Agent versions antérieures à 26.2 pour Windows | ||
| Palo Alto Networks | GlobalProtect App | GlobalProtect App toutes versions pour ChromeOS | ||
| Palo Alto Networks | PAN-OS | PAN-OS versions 11.2.4-hx antérieures à 11.2.4-h21 | ||
| Palo Alto Networks | Prisma Access | Prisma Access Agent versions antérieures à 26.3 pour Linux | ||
| Palo Alto Networks | GlobalProtect App | GlobalProtect App versions 6.2 antérieures à 6.2.8-h14 | ||
| Palo Alto Networks | GlobalProtect App | GlobalProtect App toutes versions pour iOS | ||
| Palo Alto Networks | PAN-OS | PAN-OS versions 11.1.16-hx antérieures à 11.1.16-h2 | ||
| Palo Alto Networks | Prisma Access | Prisma Browser versions antérieures à 151.26.5.170 | ||
| Palo Alto Networks | PAN-OS | PAN-OS versions 12.1.4-hx antérieures à 12.1.4-h10 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "GlobalProtect App versions 6.3 ant\u00e9rieures \u00e0 6.3.3-h15",
"product": {
"name": "GlobalProtect App",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "PAN-OS versions 12.1.x ant\u00e9rieures \u00e0 12.1.10",
"product": {
"name": "PAN-OS",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "GlobalProtect App toutes versions pour Android",
"product": {
"name": "GlobalProtect App",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "Prisma Access versions ant\u00e9rieures \u00e0 11.2.0 sans les derniers correctifs de s\u00e9curit\u00e9",
"product": {
"name": "Prisma Access",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "Prisma Access versions ant\u00e9rieures \u00e0 10.2.0 sans les derniers correctifs de s\u00e9curit\u00e9",
"product": {
"name": "Prisma Access",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "Checkov by Prisma Cloud versions 3.2.x ant\u00e9rieures \u00e0 3.2.532",
"product": {
"name": "Checkov by Prisma Cloud",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "PAN-OS versions 11.1.4-hx ant\u00e9rieures \u00e0 11.1.4-h36",
"product": {
"name": "PAN-OS",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "PAN-OS versions 12.2.x ant\u00e9rieures \u00e0 12.2.3",
"product": {
"name": "PAN-OS",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "PAN-OS versions ant\u00e9rieures \u00e0 10.2.7-h37",
"product": {
"name": "PAN-OS",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "GlobalProtect App versions 6.0 ant\u00e9rieures \u00e0 6.0.15",
"product": {
"name": "GlobalProtect App",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "Cloud NGFW toutes versions",
"product": {
"name": "Cloud NGFW",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "PAN-OS versions 11.2.13-hx ant\u00e9rieures \u00e0 11.2.13-h2",
"product": {
"name": "PAN-OS",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "Cortex XDR Broker versions ant\u00e9rieures \u00e0 32.0.52",
"product": {
"name": "Cortex XDR Broker",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "Prisma Access Agent versions ant\u00e9rieures \u00e0 26.2 pour Windows",
"product": {
"name": "Prisma Access",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "GlobalProtect App toutes versions pour ChromeOS",
"product": {
"name": "GlobalProtect App",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "PAN-OS versions 11.2.4-hx ant\u00e9rieures \u00e0 11.2.4-h21",
"product": {
"name": "PAN-OS",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "Prisma Access Agent versions ant\u00e9rieures \u00e0 26.3 pour Linux",
"product": {
"name": "Prisma Access",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "GlobalProtect App versions 6.2 ant\u00e9rieures \u00e0 6.2.8-h14",
"product": {
"name": "GlobalProtect App",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "GlobalProtect App toutes versions pour iOS",
"product": {
"name": "GlobalProtect App",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "PAN-OS versions 11.1.16-hx ant\u00e9rieures \u00e0 11.1.16-h2",
"product": {
"name": "PAN-OS",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "Prisma Browser versions ant\u00e9rieures \u00e0 151.26.5.170",
"product": {
"name": "Prisma Access",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
},
{
"description": "PAN-OS versions 12.1.4-hx ant\u00e9rieures \u00e0 12.1.4-h10",
"product": {
"name": "PAN-OS",
"vendor": {
"name": "Palo Alto Networks",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-84357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84357"
},
{
"name": "CVE-2026-76046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76046"
},
{
"name": "CVE-2026-0305",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0305"
},
{
"name": "CVE-2026-0308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0308"
},
{
"name": "CVE-2026-0303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0303"
},
{
"name": "CVE-2026-79016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79016"
},
{
"name": "CVE-2026-84348",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84348"
},
{
"name": "CVE-2026-76020",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76020"
},
{
"name": "CVE-2026-0307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0307"
},
{
"name": "CVE-2026-84351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84351"
},
{
"name": "CVE-2026-0304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0304"
},
{
"name": "CVE-2026-79286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79286"
},
{
"name": "CVE-2026-76038",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76038"
},
{
"name": "CVE-2026-79282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79282"
},
{
"name": "CVE-2026-79290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79290"
},
{
"name": "CVE-2026-0309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0309"
},
{
"name": "CVE-2026-84358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84358"
},
{
"name": "CVE-2026-0302",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0302"
},
{
"name": "CVE-2026-79195",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79195"
},
{
"name": "CVE-2026-76022",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76022"
},
{
"name": "CVE-2026-79118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79118"
},
{
"name": "CVE-2026-79293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79293"
},
{
"name": "CVE-2026-79032",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79032"
},
{
"name": "CVE-2026-76047",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-76047"
},
{
"name": "CVE-2026-0310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0310"
},
{
"name": "CVE-2026-84350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84350"
},
{
"name": "CVE-2026-84359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84359"
},
{
"name": "CVE-2026-0306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0306"
}
],
"initial_release_date": "2026-09-10T00:00:00",
"last_revision_date": "2026-09-10T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1156",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-09-10T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Palo Alto Networks. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une injection de code indirecte \u00e0 distance (XSS).",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Palo Alto Networks",
"vendor_advisories": [
{
"published_at": "2026-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks",
"url": "https://security.paloaltonetworks.com/CVE-2026-0302"
},
{
"published_at": "2026-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2026-0308",
"url": "https://security.paloaltonetworks.com/CVE-2026-0308"
},
{
"published_at": "2026-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks PAN-SA-2026-0012",
"url": "https://security.paloaltonetworks.com/PAN-SA-2026-0012"
},
{
"published_at": "2026-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks",
"url": "https://security.paloaltonetworks.com/CVE-2026-0304"
},
{
"published_at": "2026-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks",
"url": "https://security.paloaltonetworks.com/CVE-2026-0305"
},
{
"published_at": "2026-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2026-0303",
"url": "https://security.paloaltonetworks.com/CVE-2026-0303"
},
{
"published_at": "2026-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks",
"url": "https://security.paloaltonetworks.com/CVE-2026-0307"
},
{
"published_at": "2026-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2026-0310",
"url": "https://security.paloaltonetworks.com/CVE-2026-0310"
},
{
"published_at": "2026-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks",
"url": "https://security.paloaltonetworks.com/CVE-2026-0306"
},
{
"published_at": "2026-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Palo Alto Networks CVE-2026-0309",
"url": "https://security.paloaltonetworks.com/CVE-2026-0309"
}
]
}