PAN-OS
- Software type
- Operating system
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, PAN-OS recorded 11 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. Notably, 1 of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of PAN-OS and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-0322PAN-OS: Authenticated Remote Code Execution (RCE) in the Management InterfaceCVE-2026-0321PAN-OS: Denial of Service (DoS) Vulnerabilities in Network ServicesCVE-2026-0320PAN-OS: Authenticated Admin Command Injection VulnerabilityCVE-2026-0319PAN-OS: Improper Input Handling VulnerabilityCVE-2026-0318PAN-OS: Denial of Service (DoS) on Panorama| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-0322PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface | Exploitation statusKEV | FixYes |
| SeverityHigh |
CVE-2026-0321PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-0320PAN-OS: Authenticated Admin Command Injection Vulnerability | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-0319PAN-OS: Improper Input Handling Vulnerability | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-0318PAN-OS: Denial of Service (DoS) on Panorama | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityMedium |
|---|
CVE-2026-0317PAN-OS: Denial of Service Vulnerability | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityLow |
|---|
CVE-2026-0316PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability | Exploitation statusNot exploited | FixYes | Published10/14/2026 | SeverityLow |
|---|
CVE-2026-0310Palo Alto Networks PAN-OS XML buffer overflow enables denial of service or root code execution | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityHigh |
|---|
CVE-2026-0309PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityMedium |
|---|
CVE-2026-0308PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface | Exploitation statusNot exploited | FixYes | Published09/10/2026 | SeverityLow |
|---|
CVE-2026-0301PAN-OS: Information Disclosure Vulnerability in URL Filtering | Exploitation statusNot exploited | FixYes | Published08/13/2026 | SeverityLow |
|---|
CVE-2026-0287PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing | Exploitation statusNot exploited | FixYes | Published07/09/2026 | SeverityMedium |
|---|
CVE-2026-0286PAN-OS: Authenticated Command Injection in CLI | Exploitation statusNot exploited | FixYes | Published07/09/2026 | SeverityMedium |
|---|
CVE-2026-0285PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface | Exploitation statusNot exploited | FixYes | Published07/09/2026 | SeverityMedium |
|---|
CVE-2026-0284PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) | Exploitation statusNot exploited | FixYes | Published07/09/2026 | SeverityMedium |
|---|
CVE-2026-0283PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN) | Exploitation statusNot exploited | FixYes | Published07/09/2026 | SeverityMedium |
|---|
CVE-2026-0282PAN-OS: File Deletion Vulnerability in Management Web Interface | Exploitation statusNot exploited | FixYes | Published07/09/2026 | SeverityLow |
|---|
CVE-2026-0281PAN-OS: Information Disclosure Vulnerability in Management Web Interface | Exploitation statusNot exploited | FixYes | Published07/09/2026 | SeverityLow |
|---|
CVE-2026-0280PAN-OS: IPv6 Firewall Policy Bypass | Exploitation statusNot exploited | FixYes | Published07/09/2026 | SeverityLow |
|---|
CVE-2026-0279PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities | Exploitation statusNot exploited | FixYes | Published07/09/2026 | SeverityLow |
|---|
CVE-2026-0288PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent | Exploitation statusNot exploited | FixYes | Published07/08/2026 | SeverityHigh |
|---|
CVE-2026-0273PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI | Exploitation statusNot exploited | FixYes | Published06/10/2026 | SeverityMedium |
|---|
CVE-2026-0272PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI) | Exploitation statusNot exploited | FixYes | Published06/10/2026 | SeverityMedium |
|---|
CVE-2026-0269PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing | Exploitation statusNot exploited | FixYes | Published06/10/2026 | SeverityMedium |
|---|
CVE-2026-0266PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface | Exploitation statusNot exploited | FixYes | Published06/10/2026 | SeverityLow |
|---|
CVE-2026-0265PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2026-0264PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2026-0263PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2026-0262PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-0261PAN-OS: Authenticated Admin Command Injection Vulnerability | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-0258PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-0257PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities | Exploitation statusKEV | FixYes | Published05/13/2026 | SeverityHigh |
|---|
CVE-2026-0256PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface | Exploitation statusNot exploited | FixYes | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-0300PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal | Exploitation statusKEV | FixYes | Published05/06/2026 | SeverityCritical |
|---|
CVE-2026-0229PAN-OS: Denial of Service in Advanced DNS Security Feature | Exploitation statusActively exploited | FixYes | Published02/11/2026 | SeverityMedium |
|---|
CVE-2026-0228PAN-OS: Improper Validation of Terminal Server Agent Certificate | Exploitation statusNot exploited | FixYes | Published02/11/2026 | SeverityLow |
|---|
CVE-2026-0227PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal | Exploitation statusNot exploited | FixYes | Published01/15/2026 | SeverityMedium |
|---|
CVE-2025-4619PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Packets | Exploitation statusNot exploited | FixYes | Published11/13/2025 | SeverityMedium |
|---|
CVE-2025-4615PAN-OS: Improper Neutralization of Input in the Management Web Interface | Exploitation statusNot exploited | FixYes | Published10/09/2025 | SeverityMedium |
|---|
CVE-2025-4614PAN-OS: Session Token Disclosure Vulnerability | Exploitation statusNot exploited | FixYes | Published10/09/2025 | SeverityMedium |
|---|
CVE-2025-2182PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK) | Exploitation statusNot exploited | FixYes | Published08/13/2025 | SeverityMedium |
|---|
CVE-2025-4229PAN-OS: Traffic Information Disclosure Vulnerability | Exploitation statusNot exploited | FixYes | Published06/13/2025 | SeverityMedium |
|---|
CVE-2025-4231PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface | Exploitation statusNot exploited | FixYes | Published06/12/2025 | SeverityHigh |
|---|
CVE-2025-4230PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI | Exploitation statusNot exploited | FixYes | Published06/12/2025 | SeverityHigh |
|---|
CVE-2025-0137PAN-OS: Improper Neutralization of Input in the Management Web Interface | Exploitation statusNot exploited | FixYes | Published05/14/2025 | SeverityMedium |
|---|
CVE-2025-0136PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices | Exploitation statusNot exploited | FixYes | Published05/14/2025 | SeverityMedium |
|---|
CVE-2025-0133PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal | Exploitation statusNot exploited | FixYes | Published05/14/2025 | SeverityLow |
|---|
CVE-2025-0130PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets | Exploitation statusNot exploited | FixYes | Published05/14/2025 | SeverityHigh |
|---|
CVE-2025-0128PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet | Exploitation statusNot exploited | FixYes | Published04/11/2025 | SeverityHigh |
|---|
CVE-2025-0127PAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-Series | Exploitation statusNot exploited | FixYes | Published04/11/2025 | SeverityHigh |
|---|
109 Results | Page 1 of 3