PAN-OS
- Software type
- Operating system
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, PAN-OS recorded 11 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. Notably, 1 of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of PAN-OS and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2025-0126PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML LoginCVE-2025-0125PAN-OS: Improper Neutralization of Input in the Management Web InterfaceCVE-2025-0124PAN-OS: Authenticated File Deletion Vulnerability on the Management Web InterfaceCVE-2025-0123PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet CapturesCVE-2025-0116PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted LLDP Frame| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2025-0126PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2025-0125PAN-OS: Improper Neutralization of Input in the Management Web Interface | Exploitation statusNot exploited | FixYes | Published04/11/2025 | SeverityMedium |
|---|
CVE-2025-0124PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface | Exploitation statusNot exploited | FixYes | Published04/11/2025 | SeverityMedium |
|---|
CVE-2025-0123PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures | Exploitation statusNot exploited | FixYes | Published04/11/2025 | SeverityMedium |
|---|
CVE-2025-0116PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted LLDP Frame | Exploitation statusNot exploited | FixYes | Published03/12/2025 | SeverityMedium |
|---|
CVE-2025-0115PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI | Exploitation statusNot exploited | FixYes | Published03/12/2025 | SeverityMedium |
|---|
CVE-2025-0114PAN-OS: Denial of Service (DoS) in GlobalProtect | Exploitation statusNot exploited | FixYes | Published03/12/2025 | SeverityHigh |
|---|
CVE-2025-0111PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface | Exploitation statusKEV | FixYes | Published02/12/2025 | SeverityHigh |
|---|
CVE-2025-0109PAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web Interface | Exploitation statusNot exploited | FixYes | Published02/12/2025 | SeverityMedium |
|---|
CVE-2025-0108PAN-OS: Authentication Bypass in the Management Web Interface | Exploitation statusKEV | FixYes | Published02/12/2025 | SeverityHigh |
|---|
CVE-2024-3393PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet | Exploitation statusKEV | FixYes | Published12/27/2024 | SeverityHigh |
|---|
CVE-2024-9474PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface | Exploitation statusKEV | FixYes | Published11/18/2024 | SeverityMedium |
|---|
CVE-2024-0012PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) | Exploitation statusKEV | FixYes | Published11/18/2024 | SeverityCritical |
|---|
CVE-2024-9472PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic | Exploitation statusNot exploited | FixYes | Published11/14/2024 | SeverityHigh |
|---|
CVE-2024-5920PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator | Exploitation statusNot exploited | FixYes | Published11/14/2024 | SeverityMedium |
|---|
CVE-2024-5919PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability | Exploitation statusNot exploited | FixYes | Published11/14/2024 | SeverityMedium |
|---|
CVE-2024-5918PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User | Exploitation statusNot exploited | FixYes | Published11/14/2024 | SeverityMedium |
|---|
CVE-2024-5917PAN-OS: Server-Side Request Forgery in WildFire | Exploitation statusNot exploited | FixYes | Published11/14/2024 | SeverityLow |
|---|
CVE-2024-2552PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI) | Exploitation statusNot exploited | FixYes | Published11/14/2024 | SeverityMedium |
|---|
CVE-2024-2551PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet | Exploitation statusNot exploited | FixYes | Published11/14/2024 | SeverityHigh |
|---|
CVE-2024-2550PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet | Exploitation statusNot exploited | FixYes | Published11/14/2024 | SeverityHigh |
|---|
CVE-2024-9471PAN-OS: Privilege Escalation (PE) Vulnerability in XML API | Exploitation statusNot exploited | FixYes | Published10/09/2024 | SeverityMedium |
|---|
CVE-2024-9468PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet | Exploitation statusNot exploited | FixYes | Published10/09/2024 | SeverityHigh |
|---|
CVE-2024-8691PAN-OS: User Impersonation in GlobalProtect Portal | Exploitation statusNot exploited | FixYes | Published09/11/2024 | SeverityMedium |
|---|
CVE-2024-8688PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI) | Exploitation statusNot exploited | FixYes | Published09/11/2024 | SeverityMedium |
|---|
CVE-2024-8687PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes | Exploitation statusNot exploited | FixYes | Published09/11/2024 | SeverityMedium |
|---|
CVE-2024-8686PAN-OS: Command Injection Vulnerability | Exploitation statusNot exploited | FixYes | Published09/11/2024 | SeverityHigh |
|---|
CVE-2024-5916PAN-OS: Cleartext Exposure of External System Secrets | Exploitation statusNot exploited | FixYes | Published08/14/2024 | SeverityMedium |
|---|
CVE-2024-5913PAN-OS: Improper Input Validation Vulnerability in PAN-OS | Exploitation statusNot exploited | FixYes | Published07/10/2024 | SeverityMedium |
|---|
CVE-2024-5911PAN-OS: File Upload Vulnerability in the Panorama Web Interface | Exploitation statusNot exploited | FixYes | Published07/10/2024 | SeverityHigh |
|---|
CVE-2024-3400Command injection in Palo Alto Networks PAN-OS GlobalProtect enables root code execution | Exploitation statusKEV | FixYes | Published04/12/2024 | SeverityCritical |
|---|
CVE-2024-3388PAN-OS: User Impersonation in GlobalProtect SSL VPN | Exploitation statusNot exploited | FixYes | Published04/10/2024 | SeverityMedium |
|---|
CVE-2024-3387PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure | Exploitation statusNot exploited | FixYes | Published04/10/2024 | SeverityMedium |
|---|
CVE-2024-3386PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended | Exploitation statusNot exploited | FixYes | Published04/10/2024 | SeverityMedium |
|---|
CVE-2024-3385PAN-OS: Firewall Denial of Service (DoS) when GTP Security is Disabled | Exploitation statusNot exploited | FixYes | Published04/10/2024 | SeverityHigh |
|---|
CVE-2024-3384PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets | Exploitation statusNot exploited | FixYes | Published04/10/2024 | SeverityHigh |
|---|
CVE-2024-3383PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE) | Exploitation statusNot exploited | FixYes | Published04/10/2024 | SeverityHigh |
|---|
CVE-2024-3382PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted Packets | Exploitation statusNot exploited | FixYes | Published04/10/2024 | SeverityHigh |
|---|
CVE-2024-2433PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss | Exploitation statusNot exploited | FixYes | Published03/13/2024 | SeverityMedium |
|---|
CVE-2024-0011PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication | Exploitation statusNot exploited | FixYes | Published02/14/2024 | SeverityMedium |
|---|
CVE-2024-0010PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Portal | Exploitation statusNot exploited | FixYes | Published02/14/2024 | SeverityMedium |
|---|
CVE-2024-0009PAN-OS: Improper IP Address Verification in GlobalProtect Gateway | Exploitation statusNot exploited | FixYes | Published02/14/2024 | SeverityMedium |
|---|
CVE-2024-0008PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface | Exploitation statusNot exploited | FixYes | Published02/14/2024 | SeverityMedium |
|---|
CVE-2024-0007PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface | Exploitation statusNot exploited | FixYes | Published02/14/2024 | SeverityMedium |
|---|
CVE-2023-6795PAN-OS: OS Command Injection Vulnerability in the Web Interface | Exploitation statusNot confirmed | FixYes | Published12/13/2023 | SeverityMedium |
|---|
CVE-2023-6794PAN-OS: File Upload Vulnerability in the Web Interface | Exploitation statusNot confirmed | FixYes | Published12/13/2023 | SeverityMedium |
|---|
CVE-2023-6793PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator | Exploitation statusNot exploited | FixYes | Published12/13/2023 | SeverityLow |
|---|
CVE-2023-6792PAN-OS: OS Command Injection Vulnerability in the XML API | Exploitation statusNot exploited | FixYes | Published12/13/2023 | SeverityMedium |
|---|
CVE-2023-6791PAN-OS: Plaintext Disclosure of External System Integration Credentials | Exploitation statusNot exploited | FixYes | Published12/13/2023 | SeverityMedium |
|---|
CVE-2023-6790PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface | Exploitation statusNot confirmed | FixYes | Published12/13/2023 | SeverityHigh |
|---|
109 Results | Page 2 of 3