| 9.2 | CVE-2026-111497
Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products | PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Cloud - Application Security Transporter Client | < 12.2.4-h1 < 12.1.4-h13, < 12.1.7-h11, < 12.1.10-h3 < 11.2.4-h23, < 11.2.7-h23, < 11.2.10-h17, < 11.2.13-h4, < 11.2.16-h1 None None < 0.2.9 | >= 12.2.4-h1 >= 12.1.4-h13, >= 12.1.7-h11, >= 12.1.10-h3 >= 11.2.4-h23, >= 11.2.7-h23, >= 11.2.10-h17, >= 11.2.13-h4, >= 11.2.16-h1 All All >= 0.2.9 | 2026-10-26 | 2026-10-31 |
| 9.2 | CVE-2026-109618
Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products | Bridgecrew Cloud NGFW Cortex Cloud Cortex XCORE (SaaS) Cortex XDR Agent Cortex XDR Broker VM Cortex XSIAM Cortex XSOAR Cortex Xpanse GlobalProtect App Idira Koi Next Generation Trust Security PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access Agent Prisma AIRS AI Gateway Prisma Cloud Prisma Access Prisma SD-WAN Controller Prisma SD-WAN ION Prisma SD-WAN On-Prem Controller Strata Cloud Manager Trust Protection Foundation WildFire Appliance WF-500 and WF-500-B WildFire Cloud | None None None None * None None None None None None None None None < 12.2.4-h1 < 12.1.4-h13, < 12.1.7-h11, < 12.1.10-h3 < 11.2.4-h23, < 11.2.7-h23, < 11.2.10-h16, < 11.2.13-h4, < 11.2.16-h1 < 11.1.4-h38, < 11.1.6-h40, < 11.1.7-h12, < 11.1.10-h36, < 11.1.13-h16, < 11.1.16-h4 < 10.2.7-h39, < 10.2.10-h42, < 10.2.13-h27, < 10.2.16-h12, < 10.2.18-h13 None None None None None None None None None None None ** | All All All All * All All All All All All All All All >= 12.2.4-h1 >= 12.1.4-h13, >= 12.1.7-h11, >= 12.1.10-h3 >= 11.2.4-h23, >= 11.2.7-h23, >= 11.2.10-h16, >= 11.2.13-h4, >= 11.2.16-h1 >= 11.1.4-h38, >= 11.1.6-h40, >= 11.1.7-h12, >= 11.1.10-h36, >= 11.1.13-h16, >= 11.1.16-h4 >= 10.2.7-h39, >= 10.2.10-h42, >= 10.2.13-h27, >= 10.2.16-h12, >= 10.2.18-h13 All All All All All All All All All All All ** | 2026-10-21 | 2026-10-29 |
| 6.1 | CVE-2026-0320
PAN-OS: Authenticated Admin Command Injection Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.2.4 < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2 < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16 < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3 < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12 None | All >= 12.2.4 >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2 >= 11.2.4-h22, >= 11.2.7-h21, >= 11.2.10-h15, >= 11.2.13-h3, >= 11.2.16 >= 11.1.4-h37, >= 11.1.6-h39, >= 11.1.7-h11, >= 11.1.10-h35, >= 11.1.13-h15, >= 11.1.16-h3 >= 10.2.7-h38, >= 10.2.10-h41, >= 10.2.13-h26, >= 10.2.16-h11, >= 10.2.18-h12 All | 2026-10-14 | 2026-10-15 |
| 8.6 | CVE-2026-0322
PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.2.4 < 12.1.4-h12, < 12.1.7-h8, < 12.1.10-h2 < 11.2.4-h22, < 11.2.7-h21, < 11.2.10-h15, < 11.2.13-h3, < 11.2.16 < 11.1.4-h37, < 11.1.6-h39, < 11.1.7-h11, < 11.1.10-h35, < 11.1.13-h15, < 11.1.16-h3 < 10.2.7-h38, < 10.2.10-h41, < 10.2.13-h26, < 10.2.16-h11, < 10.2.18-h12 None | All >= 12.2.4 >= 12.1.4-h12, >= 12.1.7-h8, >= 12.1.10-h2 >= 11.2.4-h22, >= 11.2.7-h21, >= 11.2.10-h15, >= 11.2.13-h3, >= 11.2.16 >= 11.1.4-h37, >= 11.1.6-h39, >= 11.1.7-h11, >= 11.1.10-h35, >= 11.1.13-h15, >= 11.1.16-h3 >= 10.2.7-h38, >= 10.2.10-h41, >= 10.2.13-h26, >= 10.2.16-h11, >= 10.2.18-h12 All | 2026-10-14 | 2026-10-15 |
| 1.2 | CVE-2026-0317
PAN-OS: Denial of Service Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access | None < 12.2.4 < 12.1.10-h2 < 11.2.16 < 11.1.16-h3 None | All >= 12.2.4 >= 12.1.10-h2 >= 11.2.16 >= 11.1.16-h3 All | 2026-10-14 | 2026-10-15 |
| 1.1 | CVE-2026-0316
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 Prisma Access | None < 12.2.4 < 12.1.10-h2 < 11.2.16 < 11.1.16-h3 None | All >= 12.2.4 >= 12.1.10-h2 >= 11.2.16 >= 11.1.16-h3 All | 2026-10-14 | 2026-10-15 |
| 4 | CVE-2026-0309
PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration | Cloud NGFW PAN-OS 12.2 PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.2.3 < 12.1.4-h10, < 12.1.7-h5, < 12.1.10 < 11.2.4-h21, < 11.2.7-h20, < 11.2.10-h14, < 11.2.13-h2 < 11.1.4-h36, < 11.1.6-h38, < 11.1.7-h10, < 11.1.10-h33, < 11.1.13-h12, < 11.1.16-h2 < 10.2.7-h37, < 10.2.10-h40, < 10.2.13-h24, < 10.2.16-h10, < 10.2.18-h10 None | All >= 12.2.3 >= 12.1.4-h10, >= 12.1.7-h5, >= 12.1.10 >= 11.2.4-h21, >= 11.2.7-h20, >= 11.2.10-h14, >= 11.2.13-h2 >= 11.1.4-h36, >= 11.1.6-h38, >= 11.1.7-h10, >= 11.1.10-h33, >= 11.1.13-h12, >= 11.1.16-h2 >= 10.2.7-h37, >= 10.2.10-h40, >= 10.2.13-h24, >= 10.2.16-h10, >= 10.2.18-h10 All | 2026-09-09 | 2026-09-09 |
| 4.1 | CVE-2026-0295
GlobalProtect App: Local Privilege Escalation via Race Condition on macOS | GlobalProtect App GlobalProtect App 6.3 GlobalProtect App 6.2 GlobalProtect App 6.0 | None on Linux, None on Windows, None on iOS, None on Android, None on Chrome OS < 6.3.3-h14 (6.3.3-1121) on macOS < 6.2.8-h13 (6.2.8-1045) on macOS < 6.0.15 on macOS | All on Linux, All on Windows, All on iOS, All on Android, All on Chrome OS >= 6.3.3-h14 (6.3.3-1121) on macOS >= 6.2.8-h13 (6.2.8-1045) on macOS >= 6.0.15 on macOS (ETA: 10/29) | 2026-08-12 | 2026-09-12 |
| 2.7 | CVE-2026-0282
PAN-OS: File Deletion Vulnerability in Management Web Interface | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.8 < 11.2.13 < 11.1.16 All None | All >= 12.1.8 >= 11.2.13 >= 11.1.16 None All | 2026-07-08 | 2026-07-08 |
| 2.1 | CVE-2026-0281
PAN-OS: Information Disclosure Vulnerability in Management Web Interface | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.8 < 11.2.13 < 11.1.16 All None | All >= 12.1.8 >= 11.2.13 >= 11.1.16 None All | 2026-07-08 | 2026-07-08 |
| 1.3 | CVE-2026-0279
PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 12.1 Prisma Access 11.2 Prisma Access 10.2 | None < 12.1.8 < 11.2.13 < 11.1.16 All < 12.1.8* All* All* | All >= 12.1.8 >= 11.2.13 >= 11.1.16 None >= 12.1.8* None* None* | 2026-07-08 | 2026-07-08 |
| 4.7 | CVE-2026-0285
PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.4-h8, < 12.1.7-h2, < 12.1.8 < 11.2.4-h20, < 11.2.7-h18, < 11.2.10-h11, < 11.2.13 < 11.1.4-h35, < 11.1.6-h35, < 11.1.7-h8, < 11.1.10-h30, < 11.1.13-h9, < 11.1.16 < 10.2.7-h36, < 10.2.10-h39, < 10.2.13-h23, < 10.2.16-h9, < 10.2.18-h8 None | All >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h11, >= 11.2.13 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16 >= 10.2.7-h36, >= 10.2.10-h39, >= 10.2.13-h23, >= 10.2.16-h9, >= 10.2.18-h8 All | 2026-07-08 | 2026-07-08 |
| 4.8 | CVE-2026-0270
Cortex XSOAR: Path Traversal Vulnerability | Cortex XSOAR 8.13 Cortex XSOAR 8.12 Cortex XSOAR 8.11 Cortex XSOAR 8.10 Cortex XSOAR 6.14 Cortex XSOAR 6.13 Cortex XSOAR 6.12 | < 8.13.0.11 on Linux All All All None None None | >= 8.13.0.11 on Linux None None None All All All | 2026-06-10 | 2026-06-10 |
| 6.1 | CVE-2026-0273
PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.4-h7, < 12.1.7 < 11.2.4-h18, < 11.2.7-h16, < 11.2.10-h9, < 11.2.12 < 11.1.4-h34, < 11.1.6-h33, < 11.1.7-h7, < 11.1.10-h27, < 11.1.13-h7, < 11.1.15 < 10.2.7-h35, < 10.2.10-h37, < 10.2.13-h22, < 10.2.16-h8, < 10.2.18-h7 None | All >= 12.1.4-h7, >= 12.1.7 >= 11.2.4-h18, >= 11.2.7-h16, >= 11.2.10-h9, >= 11.2.12 >= 11.1.4-h34, >= 11.1.6-h33, >= 11.1.7-h7, >= 11.1.10-h27, >= 11.1.13-h7, >= 11.1.15 >= 10.2.7-h35, >= 10.2.10-h37, >= 10.2.13-h22, >= 10.2.16-h8, >= 10.2.18-h7 All | 2026-06-10 | 2026-06-11 |
| 6 | CVE-2026-0272
PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI) | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.4-h7, < 12.1.5 < 11.2.4-h18, < 11.2.7-h16, < 11.2.10-h9, < 11.2.11 < 11.1.4-h34, < 11.1.6-h33, < 11.1.7-h7, < 11.1.10-h27, < 11.1.13-h7, < 11.1.14 < 10.2.7-h35, < 10.2.10-h37, < 10.2.13-h22, < 10.2.16-h8, < 10.2.18-h5 None | All >= 12.1.4-h7, >= 12.1.5 >= 11.2.4-h18, >= 11.2.7-h16, >= 11.2.10-h9, >= 11.2.11 >= 11.1.4-h34, >= 11.1.6-h33, >= 11.1.7-h7, >= 11.1.10-h27, >= 11.1.13-h7, >= 11.1.14 >= 10.2.7-h35, >= 10.2.10-h37, >= 10.2.13-h22, >= 10.2.16-h8, >= 10.2.18-h5 All | 2026-06-10 | 2026-06-10 |
| 7.8 | CVE-2026-0257
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access 11.2.0 Prisma Access 10.2.0 | None < 12.1.4-h6, < 12.1.7 < 11.2.4-h17, < 11.2.7-h14, < 11.2.10-h7, < 11.2.12 < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5, < 11.1.15 < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7, < 10.2.18-h6 < 11.2.7-h13* < 10.2.10-h36* | All >= 12.1.4-h6, >= 12.1.7 >= 11.2.4-h17, >= 11.2.7-h14, >= 11.2.10-h7, >= 11.2.12 >= 11.1.4-h33, >= 11.1.6-h32, >= 11.1.7-h6, >= 11.1.10-h25, >= 11.1.13-h5, >= 11.1.15 >= 10.2.7-h34, >= 10.2.10-h36, >= 10.2.13-h21, >= 10.2.16-h7, >= 10.2.18-h6 >= 11.2.7-h13* >= 10.2.10-h36* | 2026-05-13 | 2026-06-03 |
| 5 | CVE-2026-0259
WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B) | WildFire WF-500 and WF-500-B 12.1.0 WildFire WF-500 and WF-500-B 11.2.0 WildFire WF-500 and WF-500-B 11.1.0 WildFire WF-500 and WF-500-B 10.2.0 | < 12.1.4-h5, < 12.1.7 < 11.2.4-h17, < 11.2.7-h13, < 11.2.10-h6, < 11.2.12 < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5, < 11.1.15 < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7, < 10.2.18-h6 | >= 12.1.4-h5, >= 12.1.7 >= 11.2.4-h17, >= 11.2.7-h13, >= 11.2.10-h6, >= 11.2.12 >= 11.1.4-h33, >= 11.1.6-h32, >= 11.1.7-h6, >= 11.1.10-h25, >= 11.1.13-h5, >= 11.1.15 >= 10.2.7-h34, >= 10.2.10-h36, >= 10.2.13-h21, >= 10.2.16-h7, >= 10.2.18-h6 | 2026-05-13 | 2026-05-28 |
| 7.2 | CVE-2026-0265
PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.4-h5, < 12.1.7 < 11.2.4-h17, < 11.2.7-h13, < 11.2.10-h6, < 11.2.12 < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5, < 11.1.15 < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7, < 10.2.18-h6 None | All >= 12.1.4-h5, >= 12.1.7 >= 11.2.4-h17, >= 11.2.7-h13, >= 11.2.10-h6, >= 11.2.12 >= 11.1.4-h33, >= 11.1.6-h32, >= 11.1.7-h6, >= 11.1.10-h25, >= 11.1.13-h5, >= 11.1.15 >= 10.2.7-h34, >= 10.2.10-h36, >= 10.2.13-h21, >= 10.2.16-h7, >= 10.2.18-h6 All | 2026-05-13 | 2026-05-28 |
| 6.1 | CVE-2026-0261
PAN-OS: Authenticated Admin Command Injection Vulnerability | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.4-h5, < 12.1.7 < 11.2.4-h17, < 11.2.7-h13, < 11.2.10-h6, < 11.2.12 < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5, < 11.1.15 < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7, < 10.2.18-h6 None | All >= 12.1.4-h5, >= 12.1.7 >= 11.2.4-h17, >= 11.2.7-h13, >= 11.2.10-h6, >= 11.2.12 >= 11.1.4-h33, >= 11.1.6-h32, >= 11.1.7-h6, >= 11.1.10-h25, >= 11.1.13-h5, >= 11.1.15 >= 10.2.7-h34, >= 10.2.10-h36, >= 10.2.13-h21, >= 10.2.16-h7, >= 10.2.18-h6 All | 2026-05-13 | 2026-05-28 |
| 9.3 | CVE-2026-0300
PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal | Cloud NGFW PAN-OS 12.1 PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 Prisma Access | None < 12.1.4-h5, < 12.1.7 < 11.2.4-h17, < 11.2.7-h13, < 11.2.10-h6, < 11.2.12 < 11.1.4-h33, < 11.1.6-h32, < 11.1.7-h6, < 11.1.10-h25, < 11.1.13-h5, < 11.1.15 < 10.2.7-h34, < 10.2.10-h36, < 10.2.13-h21, < 10.2.16-h7, < 10.2.18-h6 None | All >= 12.1.4-h5, >= 12.1.7 (ETA: 05/28) >= 11.2.4-h17, >= 11.2.7-h13, >= 11.2.10-h6, >= 11.2.12 >= 11.1.4-h33, >= 11.1.6-h32, >= 11.1.7-h6, >= 11.1.10-h25, >= 11.1.13-h5, >= 11.1.15 >= 10.2.7-h34, >= 10.2.10-h36, >= 10.2.13-h21, >= 10.2.16-h7, >= 10.2.18-h6 All | 2026-05-05 | 2026-05-28 |
| i | PAN-SA-2026-0006
Informational Bulletin: Impact assessment of OSS CVEs in PAN-OS | | | | 2026-04-08 | 2026-04-08 |
| 2 | CVE-2025-2181
Checkov by Prisma Cloud: Cleartext Exposure of Credentials | Checkov by Prisma Cloud 3.2.0 | | | 2025-08-13 | 2025-08-13 |
| 6.1 | CVE-2025-4231
PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface | Cloud NGFW PAN-OS 11.2 PAN-OS 11.1 PAN-OS 11.0 PAN-OS 10.2 PAN-OS 10.1 Prisma Access | None None None < 11.0.3 < 10.2.8 All None | All All All >= 11.0.3 >= 10.2.8 None All | 2025-06-11 | 2025-06-11 |
| 0.3 | CVE-2025-4227
GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement | GlobalProtect App GlobalProtect App 6.3 GlobalProtect App 6.2 GlobalProtect App 6.1 GlobalProtect App 6.0 | None on Linux, Android, iOS, Chrome OS, UWP ¹ < 6.3.3-h1 [6.3.3-c650] on Windows, macOS < 6.2.8-h2 [6.2.8-c243] on Windows, macOS All on Windows, macOS All on Windows, macOS | All on Linux, Android, iOS, Chrome OS, UWP ¹ >= 6.3.3-h1 [6.3.3-c650] on Windows, macOS >= 6.2.8-h2 [6.2.8-c243] on Windows, macOS None on Windows, macOS None on Windows, macOS | 2025-06-11 | 2025-06-13 |
| 1.1 | CVE-2025-0137
PAN-OS: Improper Neutralization of Input in the Management Web Interface | Cloud NGFW PAN-OS 11.2 PAN-OS 11.1 PAN-OS 10.2 PAN-OS 10.1 Prisma Access | None < 11.2.5 < 11.1.6-h14, < 11.1.8 < 10.2.13 < 10.1.14-h14 None | All >= 11.2.5 >= 11.1.6-h14, >= 11.1.8 >= 10.2.13 >= 10.1.14-h14 All | 2025-05-14 | 2025-07-11 |