Palo Alto Networks flaws being used in attacks
CISA lists 16 flaws in Palo Alto Networks products as being used in attacks, most recently on 14 Oct 2026. 6 have been used in ransomware.
Palo Alto NetworksBeing used in attacks
- On CISA’s list
- 16 flaws, added between 10 Jan 2022 and 14 Oct 2026
- Most recent
- CVE-2026-0322, Palo Alto Networks PAN-OS Code Injection Vulnerability, added 14 Oct 2026
- Used in ransomware
- 6 flaws, according to CISA
- Products
- PAN-OS (13), Expedition (3)
What to do
- Update every Palo Alto Networks product you use.Install the updates Palo Alto Networks offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Palo Alto Networks PAN-OS
CVE-2026-0322Palo Alto Networks PAN-OS Code Injection VulnerabilityPalo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Palo Alto Networks PAN-OS
CVE-2026-0257Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityPalo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Palo Alto Networks PAN-OS
CVE-2026-0300Palo Alto Networks PAN-OS Out-of-bounds Write VulnerabilityPalo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Read all
Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch. - Palo Alto Networks PAN-OS
CVE-2025-0111Palo Alto Networks PAN-OS File Read VulnerabilityPalo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Palo Alto Networks PAN-OS
CVE-2025-0108Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityPalo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Palo Alto Networks PAN-OS
CVE-2024-3393Palo Alto Networks PAN-OS Malicious DNS Packet VulnerabilityPalo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Palo Alto Networks PAN-OS
CVE-2024-9474Palo Alto Networks PAN-OS Management Interface OS Command Injection VulnerabilityPalo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Read all
Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet. - Palo Alto Networks PAN-OS
CVE-2024-0012Palo Alto Networks PAN-OS Management Interface Authentication Bypass VulnerabilityPalo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Read all
Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet. - Palo Alto Networks Expedition
CVE-2024-9465Palo Alto Networks Expedition SQL Injection VulnerabilityPalo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Palo Alto Networks Expedition
CVE-2024-9463Palo Alto Networks Expedition OS Command Injection VulnerabilityPalo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Palo Alto Networks Expedition
CVE-2024-5910Palo Alto Networks Expedition Missing Authentication VulnerabilityPalo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Palo Alto Networks PAN-OS
CVE-2024-3400Palo Alto Networks PAN-OS Command Injection VulnerabilityPalo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.CISA’s required actionApply mitigations per vendor instructions as they become available. Read all
Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule. - Palo Alto Networks PAN-OS
CVE-2022-0028Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service VulnerabilityA Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.CISA’s required actionApply updates per vendor instructions. - Palo Alto Networks PAN-OS
CVE-2017-15944Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityPalo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.CISA’s required actionApply updates per vendor instructions. - Palo Alto Networks PAN-OS
CVE-2020-2021Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityPalo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.CISA’s required actionApply updates per vendor instructions. - Palo Alto Networks PAN-OS
CVE-2019-1579Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityRemote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Palo Alto Networks on CISA’s site.