CVE-2026-0279

Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal aka Captive Portal service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payloa...

CVE-2026-0257

CVE-2026-0257 affects Palo Alto Networks PAN-OS GlobalProtect Portal and GlobalProtect Gateway (not Panorama/Cloud NGFW). The vulnerability is an authentication bypass (CWE-565) that can allow an unauthenticated attacker to bypass security restrictions and establish an unauthorized VPN connection...

EUVD-2025-33581

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authenticated to the firewall web UI. This may allow impersonation of users whose session tokens are leaked. The security risk posed by this issue...