| 6.6 | CVE-2026-0331
PAN-OS: Sensitive Information Disclosure Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 12.1 Prisma Access 11.2 Prisma Access 10.2 | All* < 12.2.4-h2 < 12.1.4-h14, < 12.1.7-h12, < 12.1.10-h4 < 11.2.4-h24, < 11.2.7-h24, < 11.2.10-h18, < 11.2.13-h5, < 11.2.16-h2 < 11.1.4-h39, < 11.1.6-h41, < 11.1.7-h13, < 11.1.10-h37, < 11.1.13-h17, < 11.1.16-h5 < 10.2.7-h40, < 10.2.10-h43, < 10.2.13-h28, < 10.2.16-h13, < 10.2.18-h14 < 12.1.10-h4* < 11.2.7-h24* < 10.2.10-h43* | None* >= 12.2.4-h2 >= 12.1.4-h14, >= 12.1.7-h12, >= 12.1.10-h4 >= 11.2.4-h24, >= 11.2.7-h24, >= 11.2.10-h18, >= 11.2.13-h5, >= 11.2.16-h2 >= 11.1.4-h39, >= 11.1.6-h41, >= 11.1.7-h13, >= 11.1.10-h37, >= 11.1.13-h17, >= 11.1.16-h5 >= 10.2.7-h40, >= 10.2.10-h43, >= 10.2.13-h28, >= 10.2.16-h13, >= 10.2.18-h14 >= 12.1.10-h4* >= 11.2.7-h24* >= 10.2.10-h43* | 2026-11-11 | 2026-11-11 |
| 6.1 | CVE-2026-0330
PAN-OS: Authenticated Remote Code Execution (RCE) in Panorama | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.2.4-h2 on Panorama < 12.1.4-h14 on Panorama, < 12.1.7-h12 on Panorama, < 12.1.10-h4 on Panorama < 11.2.4-h24 on Panorama, < 11.2.7-h24 on Panorama, < 11.2.10-h18 on Panorama, < 11.2.13-h5 on Panorama, < 11.2.16-h2 on Panorama < 11.1.4-h39 on Panorama, < 11.1.6-h41 on Panorama, < 11.1.7-h13 on Panorama, < 11.1.10-h37 on Panorama, < 11.1.13-h17 on Panorama, < 11.1.16-h5 on Panorama < 10.2.7-h40 on Panorama, < 10.2.10-h43 on Panorama, < 10.2.13-h28 on Panorama, < 10.2.16-h13 on Panorama, < 10.2.18-h14 on Panorama None | All >= 12.2.4-h2 on Panorama >= 12.1.4-h14 on Panorama, >= 12.1.7-h12 on Panorama, >= 12.1.10-h4 on Panorama >= 11.2.4-h24 on Panorama, >= 11.2.7-h24 on Panorama, >= 11.2.10-h18 on Panorama, >= 11.2.13-h5 on Panorama, >= 11.2.16-h2 on Panorama >= 11.1.4-h39 on Panorama, >= 11.1.6-h41 on Panorama, >= 11.1.7-h13 on Panorama, >= 11.1.10-h37 on Panorama, >= 11.1.13-h17 on Panorama, >= 11.1.16-h5 on Panorama >= 10.2.7-h40 on Panorama, >= 10.2.10-h43 on Panorama, >= 10.2.13-h28 on Panorama, >= 10.2.16-h13 on Panorama, >= 10.2.18-h14 on Panorama All | 2026-11-11 | 2026-11-11 |
| 4.6 | CVE-2026-0329
PAN-OS: Buffer Overflow Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 12.1 Prisma Access 11.2 Prisma Access 10.2 | None < 12.2.4-h2 < 12.1.4-h14, < 12.1.7-h12, < 12.1.10-h4 < 11.2.4-h24, < 11.2.7-h24, < 11.2.10-h18, < 11.2.13-h5, < 11.2.16-h2 < 11.1.4-h39, < 11.1.6-h41, < 11.1.7-h13, < 11.1.10-h37, < 11.1.13-h17, < 11.1.16-h5 < 10.2.7-h40, < 10.2.10-h43, < 10.2.13-h28, < 10.2.16-h13, < 10.2.18-h14 < 12.1.10-h4* < 11.2.7-h24* < 10.2.10-h43* | All >= 12.2.4-h2 >= 12.1.4-h14, >= 12.1.7-h12, >= 12.1.10-h4 >= 11.2.4-h24, >= 11.2.7-h24, >= 11.2.10-h18, >= 11.2.13-h5, >= 11.2.16-h2 >= 11.1.4-h39, >= 11.1.6-h41, >= 11.1.7-h13, >= 11.1.10-h37, >= 11.1.13-h17, >= 11.1.16-h5 >= 10.2.7-h40, >= 10.2.10-h43, >= 10.2.13-h28, >= 10.2.16-h13, >= 10.2.18-h14 >= 12.1.10-h4* >= 11.2.7-h24* >= 10.2.10-h43* | 2026-11-11 | 2026-11-11 |
| 2.7 | CVE-2026-0328
PAN-OS: User Impersonation through GlobalProtect Portal | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.2.4-h2 < 12.1.4-h14, < 12.1.7-h12, < 12.1.10-h4 < 11.2.4-h24, < 11.2.7-h24, < 11.2.10-h18, < 11.2.13-h5, < 11.2.16-h2 < 11.1.4-h39, < 11.1.6-h41, < 11.1.7-h13, < 11.1.10-h37, < 11.1.13-h17, < 11.1.16-h5 < 10.2.7-h40, < 10.2.10-h43, < 10.2.13-h28, < 10.2.16-h13, < 10.2.18-h14 None | All >= 12.2.4-h2 >= 12.1.4-h14, >= 12.1.7-h12, >= 12.1.10-h4 >= 11.2.4-h24, >= 11.2.7-h24, >= 11.2.10-h18, >= 11.2.13-h5, >= 11.2.16-h2 >= 11.1.4-h39, >= 11.1.6-h41, >= 11.1.7-h13, >= 11.1.10-h37, >= 11.1.13-h17, >= 11.1.16-h5 >= 10.2.7-h40, >= 10.2.10-h43, >= 10.2.13-h28, >= 10.2.16-h13, >= 10.2.18-h14 All | 2026-11-11 | 2026-11-11 |
| 2.3 | CVE-2026-0327
PAN-OS: Privilege Escalation Vulnerability in GlobalProtect | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access 12.1 Prisma Access 11.2 | None < 12.2.4-h2 < 12.1.10-h4 < 11.2.16-h2 < 11.1.16-h5 < 12.1.10-h4* All* | All >= 12.2.4-h2 >= 12.1.10-h4 >= 11.2.16-h2 >= 11.1.16-h5 >= 12.1.10-h4* None* | 2026-11-11 | 2026-11-11 |
| 1.7 | CVE-2026-0326
PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access | All* < 12.2.4-h2 < 12.1.10-h4 < 11.2.16-h2 < 11.1.16-h5 None | None* >= 12.2.4-h2 >= 12.1.10-h4 >= 11.2.16-h2 >= 11.1.16-h5 All | 2026-11-11 | 2026-11-11 |
| 1.3 | CVE-2026-0325
PAN-OS: GlobalProtect Authorization Bypass Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access 12.1 Prisma Access 11.2 | None < 12.2.4-h2 < 12.1.10-h4 < 11.2.16-h2 < 11.1.16-h5 < 12.1.10-h4* All* | All >= 12.2.4-h2 >= 12.1.10-h4 >= 11.2.16-h2 >= 11.1.16-h5 >= 12.1.10-h4* None* | 2026-11-11 | 2026-11-11 |
| 1.2 | CVE-2026-0317
PAN-OS: Denial of Service Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access | None < 12.2.4 < 12.1.10-h2 < 11.2.16 < 11.1.16-h3 None | All >= 12.2.4 >= 12.1.10-h2 >= 11.2.16 >= 11.1.16-h3 All | 2026-10-14 | 2026-10-15 |
| 1.1 | CVE-2026-0316
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access | None < 12.2.4 < 12.1.10-h2 < 11.2.16 < 11.1.16-h3 None | All >= 12.2.4 >= 12.1.10-h2 >= 11.2.16 >= 11.1.16-h3 All | 2026-10-14 | 2026-10-15 |
| 1.1 | CVE-2026-0308
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access | None None < 12.1.10 < 11.2.13-h2 < 11.1.16-h2 None | All All >= 12.1.10 >= 11.2.13-h2 >= 11.1.16-h2 All | 2026-09-09 | 2026-09-09 |
| 1.7 | CVE-2026-0301
PAN-OS: Information Disclosure Vulnerability in URL Filtering | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 12.1 Prisma Access 11.2 Prisma Access 10.2 | All on AWS*, All on Azure* None None None < 11.1.16-h1 < 10.2.8 None None < 10.2.10 | None on AWS*, None on Azure* All All All >= 11.1.16-h1 >= 10.2.8 All All >= 10.2.10 | 2026-08-12 | 2026-08-12 |
| 2.7 | CVE-2026-0282
PAN-OS: File Deletion Vulnerability in Management Web Interface | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.8 < 11.2.13 < 11.1.16 All None | All >= 12.1.8 >= 11.2.13 >= 11.1.16 None All | 2026-07-08 | 2026-07-08 |
| 2.1 | CVE-2026-0281
PAN-OS: Information Disclosure Vulnerability in Management Web Interface | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.8 < 11.2.13 < 11.1.16 All None | All >= 12.1.8 >= 11.2.13 >= 11.1.16 None All | 2026-07-08 | 2026-07-08 |
| 1.3 | CVE-2026-0279
PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 12.1 Prisma Access 11.2 Prisma Access 10.2 | None < 12.1.8 < 11.2.13 < 11.1.16 All < 12.1.8* All* All* | All >= 12.1.8 >= 11.2.13 >= 11.1.16 None >= 12.1.8* None* None* | 2026-07-08 | 2026-07-08 |
| 1.1 | CVE-2026-0266
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.5 < 11.2.11 < 11.1.14 All None | All >= 12.1.5 >= 11.2.11 >= 11.1.14 None All | 2026-06-10 | 2026-06-10 |
| 1.3 | CVE-2026-0228
PAN-OS: Improper Validation of Terminal Server Agent Certificate | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None None < 11.2.8 < 11.1.11 < 10.2.17 < 10.2.10-h28 on PAN-OS, < 11.2.7-h10 on PAN-OS | All All >= 11.2.8 >= 11.1.11 >= 10.2.17 >= 10.2.10-h28 on PAN-OS, >= 11.2.7-h10 on PAN-OS | 2026-02-11 | 2026-02-11 |
| 1.1 | CVE-2025-4614
PAN-OS: Session Token Disclosure Vulnerability | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None None < 11.2.8 < 11.1.6-h21 < 10.2.17 None | All All >= 11.2.8 >= 11.1.6-h21 >= 10.2.17 All | 2025-10-08 | 2025-10-08 |
| 3.3 | CVE-2025-2182
PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK) | Cloud NGFW PAN-OS PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 PAN-OS 10.1 Prisma Access | None None on devices other than PA-7500 < 11.2.8 on PA-7500 < 11.1.10 on PA-7500 None on PA-7500 None on PA-7500 None | All All on devices other than PA-7500 >= 11.2.8 on PA-7500 >= 11.1.10 on PA-7500 All on PA-7500 All on PA-7500 All | 2025-08-13 | 2025-08-13 |
| 5.7 | CVE-2025-4230
PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI | Cloud NGFW PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 PAN-OS 10.1 Prisma Access | None < 11.2.6 < 11.1.6-h14, < 11.1.10 < 10.2.10-h27 < 10.1.14-h15 None | All >= 11.2.6 >= 11.1.6-h14, >= 11.1.10 >= 10.2.10-h27 >= 10.1.14-h15 All | 2025-06-11 | 2025-06-30 |
| 2.3 | CVE-2025-4229
PAN-OS: Traffic Information Disclosure Vulnerability | Cloud NGFW PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 PAN-OS 10.1 Prisma Access | None < 11.2.7 < 11.1.10 < 10.2.16-h1, < 10.2.17 < 10.1.14-h16 None | All >= 11.2.7 >= 11.1.10 >= 10.2.16-h1, >= 10.2.17 >= 10.1.14-h16 All | 2025-06-11 | 2025-06-30 |
| 4.6 | CVE-2025-0130
PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets | Cloud NGFW PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 PAN-OS 10.1 Prisma Access | None < 11.2.5 < 11.1.6-h1, < 11.1.7-h2, < 11.1.8 None None None | All >= 11.2.5 >= 11.1.6-h1, >= 11.1.7-h2, >= 11.1.8 All All All | 2025-05-14 | 2025-05-14 |
| 2 | CVE-2025-0133
PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal | Cloud NGFW PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 PAN-OS 10.1 Prisma Access | All < 11.2.4-h9, < 11.2.7 < 11.1.6-h14, < 11.1.10-h1 < 10.2.16-h1 All All | None (See Mitigations and Workarounds) >= 11.2.4-h9, >= 11.2.7 >= 11.1.6-h14, >= 11.1.10-h1 >= 10.2.16-h1 None None (See Mitigations and Workarounds) | 2025-05-14 | 2025-07-09 |
| 1.3 | CVE-2025-0136
PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices | Cloud NGFW PAN-OS 11.2 PAN-OS 11.1 PAN-OS 11.0 PAN-OS 10.2 PAN-OS 10.1 Prisma Access | None None < 11.1.5 < 11.0.7 < 10.2.11 < 10.1.14-h14 None | All All >= 11.1.5 >= 11.0.7 >= 10.2.11 >= 10.1.14-h14 All | 2025-05-14 | 2025-05-14 |
| 1.1 | CVE-2025-0137
PAN-OS: Improper Neutralization of Input in the Management Web Interface | Cloud NGFW PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 PAN-OS 10.1 Prisma Access | None < 11.2.5 < 11.1.6-h14, < 11.1.8 < 10.2.13 < 10.1.14-h14 None | All >= 11.2.5 >= 11.1.6-h14, >= 11.1.8 >= 10.2.13 >= 10.1.14-h14 All | 2025-05-14 | 2025-07-11 |
| 1.9 | CVE-2025-0123
PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures | Cloud NGFW PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 PAN-OS 10.1 Prisma Access | None < 11.2.6 < 11.1.6-h10, < 11.1.8 < 10.2.10-h21, < 10.2.15 < 10.1.14-h13 None | All >= 11.2.6 >= 11.1.6-h10, >= 11.1.8 >= 10.2.10-h21, >= 10.2.15 >= 10.1.14-h13 All | 2025-04-09 | 2025-07-11 |