Description
An information disclosure vulnerability in the SD-WAN feature of Palo Alto Networks PAN-OS® software enables an unauthorized user to view unencrypted data sent from the firewall through the SD-WAN interface. This requires the user to be able to intercept packets sent from the firewall. Cloud NGFW and Prisma® Access are not affected by this vulnerability.
Scores
CVSS v4
6.0
EPSS
0.0039
EPSS Percentile
59.7%
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/V:D/U:Amber
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-497
Status
published
Products (6)
Palo Alto Networks/Cloud NGFW
All
Palo Alto Networks/PAN-OS
10.1.0 - 10.1.14-h16
Palo Alto Networks/PAN-OS
10.2.0 - 10.2.17
Palo Alto Networks/PAN-OS
11.1.0 - 11.1.10
Palo Alto Networks/PAN-OS
11.2.0 - 11.2.7
Palo Alto Networks/Prisma Access
All
Published
Jun 13, 2025
Tracked Since
Feb 18, 2026