Palo Alto Networks security news, known exploited PAN-OS and other product vulnerabilities, and official security advisories.
Following saves topics on this device. Email updates need a separate confirmed signup below.
Palo Alto Networks Security Advisories ↗
Check the vendor's advisory for affected versions, fixes and mitigation instructions. Catalogue inclusion confirms known exploitation; it does not establish whether your deployment is affected.
Matched by vendor and product keywords. Publication dates are shown below. Sources: BleepingComputer, The Hacker News, SecurityWeek, Dark Reading, The Record, Security Affairs, CISA.
News The Hacker News ·
In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What researchers saw was an a
Read the original reporting ↗News The Hacker News ·
Cybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls. "Artifacts from this investigation also ind
Read the original reporting ↗Matched against CISA's vendor field and ordered by date added to its catalogue, rather than disclosure date. Showing up to 20 of 16 matching catalogue entries.
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Added to CISA:
CISA recommended action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA catalogue ↗ · View CVE details →Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA catalogue ↗ · View CVE details →Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.
CISA catalogue ↗ · View CVE details →Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA catalogue ↗ · View CVE details →Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA catalogue ↗ · View CVE details →Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA catalogue ↗ · View CVE details →Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.
CISA catalogue ↗ · View CVE details →Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.
CISA catalogue ↗ · View CVE details →Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA catalogue ↗ · View CVE details →Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA catalogue ↗ · View CVE details →Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA catalogue ↗ · View CVE details →Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
Added to CISA:
CISA recommended action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.
CISA catalogue ↗ · View CVE details →A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.
Added to CISA:
CISA recommended action: Apply updates per vendor instructions.
CISA catalogue ↗ · View CVE details →Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.
Added to CISA:
CISA recommended action: Apply updates per vendor instructions.
CISA catalogue ↗ · View CVE details →Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.
Added to CISA:
CISA recommended action: Apply updates per vendor instructions.
CISA catalogue ↗ · View CVE details →Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.
Added to CISA:
CISA recommended action: Apply updates per vendor instructions.
CISA catalogue ↗ · View CVE details →News is matched using these vendor and product terms: Palo Alto Networks, PAN-OS, GlobalProtect, Cortex XDR. Vulnerabilities are matched to the Palo Alto Networks vendor field in CISA's catalogue. Keyword matching can miss related stories or include an incidental mention.
Feed snapshots refresh on a 15-minute cache interval; source outages can delay updates. Headlines and excerpts belong to their original publishers. Official advisory content is linked rather than reproduced.
Get new headlines matching your chosen technologies and topics. We check daily from 08:00 UTC and send a digest only when there are new matches. Digests may be delayed or skipped if our free-plan sending limit is reached.
Confirm your address using the email we send. We will not send digests before confirmation. Every digest includes an unsubscribe link. Instant alerts are not available.