Palo Alto Networks Cloud NGFW
114 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-0316 | | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability | LOW 1.1 | 0.3 % | ||
| CVE-2026-0317 | | PAN-OS: Denial of Service Vulnerability | LOW 1.2 | 0.3 % | ||
| CVE-2026-0318 | | PAN-OS: Denial of Service (DoS) on Panorama | MEDIUM 4.6 | 0.3 % | ||
| CVE-2026-0319 | | PAN-OS: Improper Input Handling Vulnerability | MEDIUM 4.9 | 0.3 % | ||
| CVE-2026-0320 | | PAN-OS: Authenticated Admin Command Injection Vulnerability | MEDIUM 6.1 | 0.8 % | ||
| CVE-2026-0321 | | PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services | MEDIUM 6.6 | 0.3 % | ||
| CVE-2026-0322 | | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface | HIGH 8.6 | 1.7 % | KEV | |
| CVE-2026-0308 | | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface | LOW 1.1 | 0.5 % | ||
| CVE-2026-0309 | | PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration | MEDIUM 4.0 | 0.8 % | ||
| CVE-2026-0310 | All | PAN-OS: Buffer Overflow Vulnerability via XML Processing | HIGH 7.2 | 0.7 % | ||
| CVE-2026-0301 | All | PAN-OS: Information Disclosure Vulnerability in URL Filtering | LOW 1.7 | 0.6 % | ||
| CVE-2026-0279 | | PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities | LOW 1.3 | 0.8 % | ||
| CVE-2026-0280 | | PAN-OS: IPv6 Firewall Policy Bypass | LOW 1.7 | 0.3 % | ||
| CVE-2026-0281 | | PAN-OS: Information Disclosure Vulnerability in Management Web Interface | LOW 2.1 | 0.3 % | ||
| CVE-2026-0282 | | PAN-OS: File Deletion Vulnerability in Management Web Interface | LOW 2.7 | 0.3 % | ||
| CVE-2026-0283 | | PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN) | MEDIUM 4.5 | 0.4 % | ||
| CVE-2026-0284 | | PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) | MEDIUM 4.7 | 0.5 % | ||
| CVE-2026-0285 | | PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface | MEDIUM 4.7 | 0.4 % | ||
| CVE-2026-0286 | | PAN-OS: Authenticated Command Injection in CLI | MEDIUM 6.0 | 1.7 % | ||
| CVE-2026-0287 | All | PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing | MEDIUM 6.6 | 0.6 % | ||
| CVE-2026-0288 | | PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent | HIGH 7.2 | 0.8 % | ||
| CVE-2026-0273 | | PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI | MEDIUM 6.1 | 1.3 % | ||
| CVE-2026-0272 | | PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI) | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-0269 | | PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing | MEDIUM 4.6 | 0.2 % | ||
| CVE-2026-0266 | | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface | LOW 1.1 | 0.1 % | ||
| CVE-2026-0256 | | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-0257 | | PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities | HIGH 7.8 | 95 % | KEV | |
| CVE-2026-0258 | | PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching | MEDIUM 4.8 | 0.3 % | ||
| CVE-2026-0261 | | PAN-OS: Authenticated Admin Command Injection Vulnerability | MEDIUM 6.1 | 1.4 % | ||
| CVE-2026-0262 | | PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing | MEDIUM 6.6 | 0.4 % | ||
| CVE-2026-0263 | | PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing | HIGH 7.2 | 0.4 % | ||
| CVE-2026-0264 | | PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution | HIGH 7.2 | 0.5 % | ||
| CVE-2026-0265 | | PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled | HIGH 7.2 | 1.1 % | ||
| CVE-2026-0300 | | PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal | CRITICAL 9.3 | 42 % | KEV | |
| CVE-2026-0229 | | PAN-OS: Denial of Service in Advanced DNS Security Feature | MEDIUM 6.6 | 0.6 % | ||
| CVE-2026-0228 | | PAN-OS: Improper Validation of Terminal Server Agent Certificate | LOW 1.3 | 0.2 % | ||
| CVE-2026-0227 | | PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal | MEDIUM 6.6 | 0.7 % | ||
| CVE-2025-4619 | | PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Packets | MEDIUM 6.6 | 0.6 % | ||
| CVE-2025-4615 | | PAN-OS: Improper Neutralization of Input in the Management Web Interface | MEDIUM 5.5 | 0.8 % | ||
| CVE-2025-4614 | | PAN-OS: Session Token Disclosure Vulnerability | MEDIUM 4.8 | 0.3 % | ||
| CVE-2025-2182 | | PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK) | MEDIUM 5.6 | 0.1 % | ||
| CVE-2025-4229 | | PAN-OS: Traffic Information Disclosure Vulnerability | MEDIUM 6.0 | 0.5 % | ||
| CVE-2025-4230 | | PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI | HIGH 8.4 | 0.6 % | ||
| CVE-2025-4231 | | PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface | HIGH 8.6 | 1.0 % | ||
| CVE-2025-0136 | | PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-0137 | | PAN-OS: Improper Neutralization of Input in the Management Web Interface | MEDIUM 4.8 | 0.4 % | ||
| CVE-2025-0133 | All – < 11.2.8 | PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal | LOW 2.7 | 46 % | ||
| CVE-2025-0130 | | PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets | HIGH 8.2 | 0.4 % | ||
| CVE-2025-0123 | | PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures | MEDIUM 5.9 | 0.1 % | ||
| CVE-2025-0128 | | PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet | HIGH 8.7 | 0.3 % | ||
| CVE-2025-0127 | | PAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-Series | HIGH 7.1 | 0.6 % | ||
| CVE-2025-0126 | | PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login | HIGH 8.3 | 0.4 % | ||
| CVE-2025-0125 | | PAN-OS: Improper Neutralization of Input in the Management Web Interface | MEDIUM 6.9 | 0.4 % | ||
| CVE-2025-0124 | All | PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface | MEDIUM 5.1 | 0.4 % | ||
| CVE-2025-0116 | | PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted LLDP Frame | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-0115 | | PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI | MEDIUM 6.8 | 0.2 % | ||
| CVE-2025-0114 | | PAN-OS: Denial of Service (DoS) in GlobalProtect | HIGH 8.2 | 0.4 % | ||
| CVE-2025-0111 | | PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface | HIGH 7.1 | 2.0 % | KEV | |
| CVE-2025-0109 | | PAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web Interface | MEDIUM 6.9 | 0.6 % | ||
| CVE-2025-0108 | | PAN-OS: Authentication Bypass in the Management Web Interface | HIGH 8.8 | 98 % | KEV | |
| CVE-2025-0107 | | Expedition: OS Command Injection Vulnerability | HIGH 7.7 | 78 % | ||
| CVE-2025-0106 | | Expedition: Wildcard Expansion Vulnerability | MEDIUM 6.9 | 0.5 % | ||
| CVE-2025-0105 | | Expedition: Arbitrary File Deletion Vulnerability | MEDIUM 6.9 | 13 % | ||
| CVE-2025-0104 | | Expedition: Cross-Site Scripting (XSS) Vulnerability | HIGH 7.0 | 0.4 % | ||
| CVE-2025-0103 | | Expedition: SQL Injection Vulnerability | CRITICAL 9.2 | 0.6 % | ||
| CVE-2024-3393 | | PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet | HIGH 8.7 | 29 % | KEV | |
| CVE-2024-9474 | | PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface | MEDIUM 6.9 | 94 % | KEV | |
| CVE-2024-0012 | | PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) | CRITICAL 9.3 | 100 % | KEV | |
| CVE-2024-2550 | | PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet | HIGH 8.7 | 0.5 % | ||
| CVE-2024-5920 | | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator | MEDIUM 4.6 | 0.3 % | ||
| CVE-2024-5917 | | PAN-OS: Server-Side Request Forgery in WildFire | LOW 2.1 | 0.5 % | ||
| CVE-2024-2552 | | PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI) | MEDIUM 6.8 | 0.5 % | ||
| CVE-2024-5918 | | PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User | MEDIUM 5.3 | 0.2 % | ||
| CVE-2024-5919 | | PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability | MEDIUM 5.1 | 0.3 % | ||
| CVE-2024-2551 | | PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet | HIGH 8.7 | 0.5 % | ||
| CVE-2024-9472 | | PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic | HIGH 8.7 | 0.4 % | ||
| CVE-2024-9471 | | PAN-OS: Privilege Escalation (PE) Vulnerability in XML API | MEDIUM 5.1 | 0.3 % | ||
| CVE-2024-9468 | | PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet | HIGH 8.2 | 0.4 % | ||
| CVE-2024-8691 | | PAN-OS: User Impersonation in GlobalProtect Portal | MEDIUM 5.3 | 0.3 % | ||
| CVE-2024-8688 | | PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI) | MEDIUM 6.7 | 0.2 % | ||
| CVE-2024-8687 | | PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes | MEDIUM 6.9 | 0.4 % | ||
| CVE-2024-8686 | | PAN-OS: Command Injection Vulnerability | HIGH 8.6 | 1.4 % | ||
| CVE-2024-5916 | Before 8/15 ; Before 8/23 | PAN-OS: Cleartext Exposure of External System Secrets | MEDIUM 6.0 | 0.2 % | ||
| CVE-2024-5913 | None | PAN-OS: Improper Input Validation Vulnerability in PAN-OS | MEDIUM 6.8 | 0.2 % | ||
| CVE-2024-5911 | | PAN-OS: File Upload Vulnerability in the Panorama Web Interface | HIGH 7.0 | 0.6 % | ||
| CVE-2024-3400 | | PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect | CRITICAL 10.0 | 100 % | KEV | |
| CVE-2024-3388 | | PAN-OS: User Impersonation in GlobalProtect SSL VPN | MEDIUM 5.0 | 0.3 % | ||
| CVE-2024-3387 | | PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure | MEDIUM 5.9 | 0.2 % | ||
| CVE-2024-3386 | | PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended | MEDIUM 5.3 | 0.4 % | ||
| CVE-2024-3385 | | PAN-OS: Firewall Denial of Service (DoS) when GTP Security is Disabled | HIGH 7.5 | 0.9 % | ||
| CVE-2024-3384 | | PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets | HIGH 7.5 | 0.9 % | ||
| CVE-2024-3383 | | PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE) | CRITICAL 9.1 | 0.6 % | ||
| CVE-2024-3382 | | PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted Packets | HIGH 7.5 | 0.9 % | ||
| CVE-2024-2433 | | PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss | MEDIUM 4.3 | 0.6 % | ||
| CVE-2024-0011 | | PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-0010 | | PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Portal | MEDIUM 6.1 | 0.5 % | ||
| CVE-2024-0009 | | PAN-OS: Improper IP Address Verification in GlobalProtect Gateway | MEDIUM 6.3 | 0.2 % | ||
| CVE-2024-0008 | | PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface | HIGH 8.8 | 0.5 % | ||
| CVE-2024-0007 | | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface | MEDIUM 6.8 | 0.4 % | ||
| CVE-2023-6793 | | PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator | LOW 2.7 | 0.6 % | ||
| CVE-2023-6791 | | PAN-OS: Plaintext Disclosure of External System Integration Credentials | MEDIUM 4.9 | 0.6 % | ||
| CVE-2023-6789 | | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface | MEDIUM 4.8 | 0.4 % | ||
| CVE-2023-6795 | | PAN-OS: OS Command Injection Vulnerability in the Web Interface | MEDIUM 5.5 | 1.1 % | ||
| CVE-2023-6794 | | PAN-OS: File Upload Vulnerability in the Web Interface | MEDIUM 5.5 | 0.6 % | ||
| CVE-2023-6792 | | PAN-OS: OS Command Injection Vulnerability in the XML API | MEDIUM 6.3 | 1.1 % | ||
| CVE-2023-6790 | | PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface | HIGH 8.8 | 0.7 % | ||
| CVE-2023-38046 | | PAN-OS: Read System Files and Resources During Configuration Commit | MEDIUM 5.5 | 0.5 % | ||
| CVE-2023-0010 | | PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication | MEDIUM 5.4 | 0.4 % | ||
| CVE-2023-0008 | | PAN-OS: Local File Disclosure Vulnerability in the PAN-OS Web Interface | MEDIUM 4.4 | 0.5 % | ||
| CVE-2023-0007 | | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface | MEDIUM 6.5 | 0.4 % | ||
| CVE-2023-0005 | | PAN-OS: Exposure of Sensitive Information Vulnerability | MEDIUM 4.9 | 0.3 % | ||
| CVE-2023-0004 | | PAN-OS: Local File Deletion Vulnerability | MEDIUM 6.5 | 1.1 % | ||
| CVE-2022-0030 | | PAN-OS: Authentication Bypass in Web Interface | HIGH 8.1 | 1.0 % | ||
| CVE-2022-0028 | | PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering | HIGH 8.6 | 2.7 % | KEV |