| 8.6 | CVE-2026-0322
PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.2.4 < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2 < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16 < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3 < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12 None | All >= 12.2.4 >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2 >= 11.2.4-h22, >= 11.2.7-h21, >= 11.2.10-h15, >= 11.2.13-h3, >= 11.2.16 >= 11.1.4-h37, >= 11.1.6-h39, >= 11.1.7-h11, >= 11.1.10-h35, >= 11.1.13-h15, >= 11.1.16-h3 >= 10.2.7-h38, >= 10.2.10-h41, >= 10.2.13-h26, >= 10.2.16-h11, >= 10.2.18-h12 All | 2026-10-14 | 2026-10-15 |
| 6.6 | CVE-2026-0321
PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 12.1 Prisma Access 11.2 Prisma Access 10.2 | None < 12.2.4 < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2 < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16 < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3 < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12 < 12.1.7-h8* < 11.2.7-h21* < 10.2.10-h41* | All >= 12.2.4 >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2 >= 11.2.4-h22, >= 11.2.7-h21, >= 11.2.10-h15, >= 11.2.13-h3, >= 11.2.16 >= 11.1.4-h37, >= 11.1.6-h39, >= 11.1.7-h11, >= 11.1.10-h35, >= 11.1.13-h15, >= 11.1.16-h3 >= 10.2.7-h38, >= 10.2.10-h41, >= 10.2.13-h26, >= 10.2.16-h11, >= 10.2.18-h12 >= 12.1.7-h8* >= 11.2.7-h21* >= 10.2.10-h41* | 2026-10-14 | 2026-10-15 |
| 6.1 | CVE-2026-0320
PAN-OS: Authenticated Admin Command Injection Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.2.4 < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2 < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16 < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3 < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12 None | All >= 12.2.4 >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2 >= 11.2.4-h22, >= 11.2.7-h21, >= 11.2.10-h15, >= 11.2.13-h3, >= 11.2.16 >= 11.1.4-h37, >= 11.1.6-h39, >= 11.1.7-h11, >= 11.1.10-h35, >= 11.1.13-h15, >= 11.1.16-h3 >= 10.2.7-h38, >= 10.2.10-h41, >= 10.2.13-h26, >= 10.2.16-h11, >= 10.2.18-h12 All | 2026-10-14 | 2026-10-15 |
| 4.9 | CVE-2026-0319
PAN-OS: Improper Input Handling Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 12.1 Prisma Access 11.2 Prisma Access 10.2 | None < 12.2.4 < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2 < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16 < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3 < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12 < 12.1.7-h8 < 11.2.7-h21 < 10.2.10-h41 | All >= 12.2.4 >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2 >= 11.2.4-h22, >= 11.2.7-h21, >= 11.2.10-h15, >= 11.2.13-h3, >= 11.2.16 (ETA: 10/15) >= 11.1.4-h37, >= 11.1.6-h39, >= 11.1.7-h11, >= 11.1.10-h35, >= 11.1.13-h15, >= 11.1.16-h3 >= 10.2.7-h38, >= 10.2.10-h41, >= 10.2.13-h26, >= 10.2.16-h11, >= 10.2.18-h12 >= 12.1.7-h8 >= 11.2.7-h21 >= 10.2.10-h41 | 2026-10-14 | 2026-10-14 |
| 4.6 | CVE-2026-0318
PAN-OS: Denial of Service (DoS) on Panorama | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access | None < 12.2.4 on Panorama < 12.1.4-h12 on Panorama, < 12.1.7-h8 on Panorama, < 12.1.10-h2 on Panorama < 11.2.4-h22 on Panorama, < 11.2.7-h21 on Panorama, < 11.2.10-h15 on Panorama, < 11.2.13-h3 on Panorama, < 11.2.15 on Panorama < 11.1.4-h37 on Panorama, < 11.1.6-h39 on Panorama, < 11.1.7-h11 on Panorama, < 11.1.10-h35 on Panorama, < 11.1.13-h15 on Panorama, < 11.1.16-h3 on Panorama None | All >= 12.2.4 on Panorama >= 12.1.4-h12 on Panorama, >= 12.1.7-h8 on Panorama, >= 12.1.10-h2 on Panorama >= 11.2.4-h22 on Panorama, >= 11.2.7-h21 on Panorama, >= 11.2.10-h15 on Panorama, >= 11.2.13-h3 on Panorama, >= 11.2.15 on Panorama >= 11.1.4-h37 on Panorama, >= 11.1.6-h39 on Panorama, >= 11.1.7-h11 on Panorama, >= 11.1.10-h35 on Panorama, >= 11.1.13-h15 on Panorama, >= 11.1.16-h3 on Panorama All | 2026-10-14 | 2026-10-14 |
| 1.2 | CVE-2026-0317
PAN-OS: Denial of Service Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access | None < 12.2.4 < 12.1.10-h2 < 11.2.16 < 11.1.16-h3 None | All >= 12.2.4 >= 12.1.10-h2 >= 11.2.16 >= 11.1.16-h3 All | 2026-10-14 | 2026-10-15 |
| 1.1 | CVE-2026-0316
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access | None < 12.2.4 < 12.1.10-h2 < 11.2.16 < 11.1.16-h3 None | All >= 12.2.4 >= 12.1.10-h2 >= 11.2.16 (ETA: 10/15) >= 11.1.16-h3 All | 2026-10-14 | 2026-10-14 |
| 7.2 | CVE-2026-0310
PAN-OS: Buffer Overflow Vulnerability via XML Processing | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 12.1 Prisma Access 11.2 Prisma Access 10.2 | All on AWS*, All on Azure* < 12.2.3 < 12.1.4-h10, < 12.1.7-h5, < 12.1.10 < 11.2.4-h21, < 11.2.7-h20, < 11.2.10-h14, < 11.2.13-h2 < 11.1.4-h36, < 11.1.6-h38, < 11.1.7-h10, < 11.1.10-h33, < 11.1.13-h12, < 11.1.16-h2 < 10.2.7-h37, < 10.2.10-h40, < 10.2.13-h24, < 10.2.16-h10, < 10.2.18-h10 < 12.1.7-h5* < 11.2.7-h20* < 10.2.10-h40* | None on AWS*, None on Azure* >= 12.2.3 >= 12.1.4-h10, >= 12.1.7-h5, >= 12.1.10 >= 11.2.4-h21, >= 11.2.7-h20, >= 11.2.10-h14, >= 11.2.13-h2 >= 11.1.4-h36, >= 11.1.6-h38, >= 11.1.7-h10, >= 11.1.10-h33, >= 11.1.13-h12, >= 11.1.16-h2 >= 10.2.7-h37, >= 10.2.10-h40, >= 10.2.13-h24, >= 10.2.16-h10, >= 10.2.18-h10 >= 12.1.7-h5* >= 11.2.7-h20* >= 10.2.10-h40* | 2026-09-09 | 2026-09-09 |
| 4 | CVE-2026-0309
PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.2.3 < 12.1.4-h10, < 12.1.7-h5, < 12.1.10 < 11.2.4-h21, < 11.2.7-h20, < 11.2.10-h14, < 11.2.13-h2 < 11.1.4-h36, < 11.1.6-h38, < 11.1.7-h10, < 11.1.10-h33, < 11.1.13-h12, < 11.1.16-h2 < 10.2.7-h37, < 10.2.10-h40, < 10.2.13-h24, < 10.2.16-h10, < 10.2.18-h10 None | All >= 12.2.3 >= 12.1.4-h10, >= 12.1.7-h5, >= 12.1.10 >= 11.2.4-h21, >= 11.2.7-h20, >= 11.2.10-h14, >= 11.2.13-h2 >= 11.1.4-h36, >= 11.1.6-h38, >= 11.1.7-h10, >= 11.1.10-h33, >= 11.1.13-h12, >= 11.1.16-h2 >= 10.2.7-h37, >= 10.2.10-h40, >= 10.2.13-h24, >= 10.2.16-h10, >= 10.2.18-h10 All | 2026-09-09 | 2026-09-09 |
| 1.1 | CVE-2026-0308
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access | None None < 12.1.10 < 11.2.13-h2 < 11.1.16-h2 None | All All >= 12.1.10 >= 11.2.13-h2 >= 11.1.16-h2 All | 2026-09-09 | 2026-09-09 |
| 7.2 | CVE-2026-0288
PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 11.2 Prisma Access 10.2 | None on AWS, None on Azure < 12.1.4-h8, < 12.1.7-h2, < 12.1.8 < 11.2.4-h20, < 11.2.7-h18, < 11.2.10-h12, < 11.2.13 < 11.1.4-h35, < 11.1.6-h35, < 11.1.7-h8, < 11.1.10-h30, < 11.1.13-h9, < 11.1.16 < 10.2.7-h36, < 10.2.10-h39, < 10.2.13-h23, < 10.2.16-h9, < 10.2.18-h8 < 11.2.7-h18* < 10.2.10-h39* | All on AWS, All on Azure unless you have been contacted by Palo Alto Networks >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h12, >= 11.2.13 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 >= 11.2.7-h18* >= 10.2.10-h39* | 2026-07-08 | 2026-07-08 |
| 6.6 | CVE-2026-0287
PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 11.2.0 Prisma Access 10.2.0 | All on AWS, All on Azure < 12.1.4-h8, < 12.1.7-h2, < 12.1.8 < 11.2.4-h20, < 11.2.7-h18, < 11.2.10-h12, < 11.2.13 < 11.1.4-h35, < 11.1.6-h35, < 11.1.7-h8, < 11.1.10-h30, < 11.1.13-h9, < 11.1.16 < 10.2.7-h36, < 10.2.10-h39, < 10.2.13-h23, < 10.2.16-h9, < 10.2.18-h8 < 11.2.7-h18* < 10.2.10-h39* | None on AWS, None on Azure >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h12, >= 11.2.13 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 >= 11.2.7-h18* >= 10.2.10-h39* | 2026-07-08 | 2026-07-08 |
| 6 | CVE-2026-0286
PAN-OS: Authenticated Command Injection in CLI | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.4-h8, < 12.1.7-h2, < 12.1.8 < 11.2.4-h20, < 11.2.7-h18, < 11.2.10-h11, < 11.2.13 < 11.1.4-h35, < 11.1.6-h35, < 11.1.7-h8, < 11.1.10-h30, < 11.1.13-h9, < 11.1.16 < 10.2.7-h36, < 10.2.10-h39, < 10.2.13-h23, < 10.2.16-h9, < 10.2.18-h8 None | All >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h11, >= 11.2.13 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 All | 2026-07-08 | 2026-07-08 |
| 4.7 | CVE-2026-0285
PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.4-h8, < 12.1.7-h2, < 12.1.8 < 11.2.4-h20, < 11.2.7-h18, < 11.2.10-h11, < 11.2.13 < 11.1.4-h35, < 11.1.6-h35, < 11.1.7-h8, < 11.1.10-h30, < 11.1.13-h9, < 11.1.16 < 10.2.7-h36, < 10.2.10-h39, < 10.2.13-h23, < 10.2.16-h9, < 10.2.18-h8 None | All >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h11, >= 11.2.13 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 All | 2026-07-08 | 2026-07-08 |
| 4.7 | CVE-2026-0284
PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.4-h8, < 12.1.7-h2, < 12.1.8 < 11.2.4-h20, < 11.2.7-h18, < 11.2.10-h12, < 11.2.13 < 11.1.4-h35, < 11.1.6-h35, < 11.1.7-h8, < 11.1.10-h30, < 11.1.13-h9, < 11.1.16 < 10.2.7-h36, < 10.2.10-h39, < 10.2.13-h23, < 10.2.16-h9, < 10.2.18-h8 None | All >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h12, >= 11.2.13 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 All | 2026-07-08 | 2026-07-08 |
| 4.5 | CVE-2026-0283
PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN) | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.4-h8, < 12.1.7-h2, < 12.1.8 < 11.2.4-h20, < 11.2.7-h18, < 11.2.10-h12, < 11.2.13 < 11.1.4-h35, < 11.1.6-h35, < 11.1.7-h8, < 11.1.10-h30, < 11.1.13-h9, < 11.1.16 < 10.2.7-h36, < 10.2.10-h39, < 10.2.13-h23, < 10.2.16-h9, < 10.2.18-h8 None | All >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h12, >= 11.2.13 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 All | 2026-07-08 | 2026-07-08 |
| 2.7 | CVE-2026-0282
PAN-OS: File Deletion Vulnerability in Management Web Interface | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.8 < 11.2.13 < 11.1.16 All None | All >= 12.1.8 >= 11.2.13 >= 11.1.16 None All | 2026-07-08 | 2026-07-08 |
| 2.1 | CVE-2026-0281
PAN-OS: Information Disclosure Vulnerability in Management Web Interface | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.8 < 11.2.13 < 11.1.16 All None | All >= 12.1.8 >= 11.2.13 >= 11.1.16 None All | 2026-07-08 | 2026-07-08 |
| 1.7 | CVE-2026-0280
PAN-OS: IPv6 Firewall Policy Bypass | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Panorama Prisma Access 11.2.0 Prisma Access 10.2.0 | None < 12.1.4-h8, < 12.1.7-h2, < 12.1.8 < 11.2.4-h20, < 11.2.7-h18, < 11.2.10-h11, < 11.2.13 < 11.1.4-h35, < 11.1.6-h35, < 11.1.7-h8, < 11.1.10-h30, < 11.1.13-h9, < 11.1.16 < 10.2.7-h36, < 10.2.10-h39, < 10.2.13-h23, < 10.2.16-h9, < 10.2.18-h8 None < 11.2.7-h18* < 10.2.10-h39* | All >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h11, >= 11.2.13 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 All >= 11.2.7-h18* >= 10.2.10-h39* | 2026-07-08 | 2026-07-08 |
| 1.3 | CVE-2026-0279
PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 12.1 Prisma Access 11.2 Prisma Access 10.2 | None < 12.1.8 < 11.2.13 < 11.1.16 All < 12.1.8* All* All* | All >= 12.1.8 >= 11.2.13 >= 11.1.16 None >= 12.1.8* None* None* | 2026-07-08 | 2026-07-08 |
| i | PAN-SA-2025-0005
GlobalProtect Clientless VPN: Clientless VPN Misconfiguration Allows Cross-Site Attacks | Cloud NGFW PAN-OS Prisma Access | | | 2025-02-12 | 2025-02-12 |