Palo Alto Networks Vulnerabilities and Affected Products
Vulnerabilities associated with Panorama.
Products
Clear product- PAN-OS189 vulnerabilities
- Prisma Access112 vulnerabilities
- Cloud NGFW104 vulnerabilities
- GlobalProtect App38 vulnerabilities
- Cortex XDR Agent24 vulnerabilities
- Expedition12 vulnerabilities
- Prisma Access Agent12 vulnerabilities
- Cortex XSOAR11 vulnerabilities
- GlobalProtect UWP App9 vulnerabilities
- Prisma Browser9 vulnerabilities
- Cortex XDR Broker VM8 vulnerabilities
- Panorama7 vulnerabilities
- Prisma Cloud Compute4 vulnerabilities
- Global Protect Agent3 vulnerabilities
- Trust Protection Foundation3 vulnerabilities
- Autonomous Digital Experience Manager2 vulnerabilities
- Bridgecrew Checkov2 vulnerabilities
- Checkov by Prisma Cloud2 vulnerabilities
- Palo Alto Networks Expedition2 vulnerabilities
- Palo Alto Networks PAN-OS2 vulnerabilities
- Prisma Access Browser2 vulnerabilities
- Prisma SD-WAN ION2 vulnerabilities
- Traps2 vulnerabilities
- ActiveMQ Content Pack1 vulnerability
- Broker VM1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
PAN-OS: IPv6 Firewall Policy BypassAn IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services. Cloud NGFW and Panorama are not impacted by this vulnerability. CWE-131Jul 9, 2026 | CVSS1.7v4.0 | EPSS0.188% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-0269MEDIUM | PAN-OS: Denial of Service (DoS) in Tunnel Traffic ProcessingA memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability. CWE-754Jun 10, 2026 | CVSS4.6v4.0 | EPSS0.224% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0107HIGH | Expedition: OS Command Injection VulnerabilityAn OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls running PAN-OS software. | CVSS7.7v4.0 | EPSS78.5% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2025-0106MEDIUM | Expedition: Wildcard Expansion VulnerabilityA wildcard expansion vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to enumerate files on the host filesystem. CWE-155Jan 11, 2025 | CVSS6.9v4.0 | EPSS0.483% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0105MEDIUM | Expedition: Arbitrary File Deletion VulnerabilityAn arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem. CWE-73Jan 11, 2025 | CVSS6.9v4.0 | EPSS13% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0104HIGH | Expedition: Cross-Site Scripting (XSS) VulnerabilityA reflected cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition enables attackers to execute malicious JavaScript code in the context of an authenticated Expedition user’s browser if that authenticated user clicks a malicious link that allows phishing attacks and could lead to Expedition browser-session theft. CWE-79Jan 11, 2025 | CVSS7.0v4.0 | EPSS0.357% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-0103CRITICAL | Expedition: SQL Injection VulnerabilityAn SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. This vulnerability also enables attackers to create and read arbitrary files on the Expedition system. CWE-89Jan 11, 2025 | CVSS9.2v4.0 | EPSS0.619% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |