Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting

PAN-OS management web interface is vulnerable to reflected cross-site scripting. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute...

Palo Alto Networks Expedition - OS Command Injection

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls...

Palo Alto Expedition - SQL Injection

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expeditio...

PAN-OS Management Interface - Path Confusion to Authentication Bypass

A vulnerability in PAN-OS management interface allows authentication bypass through path confusion between Nginx and Apache handlers.The issue occurs due to differences in path processing between Nginx and Apache, where double URL encoding combined with directory traversal can bypass authenticati...

CVE-2026-0296

Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle MitM access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS, Android, and Chrome ...

CVE-2026-0290

An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data...

EUVD-2026-57713

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

CVE-2026-0299

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

CVE-2026-0298 GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)

An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle MitM attacker to execute arbitrary code with SYSTEM privileges on an affected client. The...

CVE-2026-0297 GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake

A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle MitM attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges SYSTEM privileges on Windows, and root privileges on...

CVE-2026-0296 GlobalProtect App: Improper Certificate Validation Bypass Vulnerability

Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle MitM access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS, Android, and Chrome ...

CVE-2026-0296 GlobalProtect App: Improper Certificate Validation Bypass Vulnerability

Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle MitM access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS, Android, and Chrome ...

CVE-2026-0296

CVE-2026-0296 concerns Palo Alto Networks GlobalProtect, with an improper certificate validation vulnerability that enables an unauthenticated attacker to perform MitM on application communications. The issue is described as affecting the GlobalProtect app generally, with the note that iOS, Andro...

CVE-2026-0294

A privilege escalation PE vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected...

CVE-2026-0294 Prisma Access Agent: Local Privilege Escalation

A privilege escalation PE vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected...

CVE-2026-0291

CVE-2026-0291 affects Palo Alto Networks Prisma Access Agent on Linux. It is an improper link resolution before file access vulnerability that enables a local, low-privilege user to delete system files in a limited scope and disable the Prisma Access Agent. Affected: Linux; not affected on macOS,...

CVE-2026-0290

Technical details about CVE-2026-0290 are not publicly available in the provided documents. Monitor for updates; descriptions indicate an information disclosure in Prisma Browser Account Protection, but no affected versions, attack vectors, or remediation are specified.

Palo Alto Networks PAN-OS 10.2.x < 10.2.8 / 11.1.x < 11.1.16-h1 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.2.x prior to 10.2.8 or 11.1.x prior to 11.1.16-h1. It is, therefore, affected by a vulnerability. An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS software enables an...

PT-2026-71100

Credentials for a deleted user may remain valid for a short period under specific conditions...

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Threat actors have been observed exploiting a now-patched high-severity Palo Alto Networks PAN-OS vulnerability as an entry point to deploy Qilin aka Agenda ransomware on victim environments. Arctic Wolf Labs said it investigated multiple intrusions in June 2026 that began with the exploitation o...