PA
Network Security
PAN-OS
On CISA KEVExploited in the wildRansomware-linked
306
CVEs
17
On KEV
10.0
Max CVSS
9
New 30D
Severity mix
Critical 28High 121Medium 117Low 19
Watch
Add PAN-OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-0023 | 5.9 | Apr 13 | PAN-OS: Denial-of-Service (DoS) Vulnerability in DNS Proxy Affected: 8.1 before 8.1.22; 9.1 before 9.1.13; 10.1 before 10.1.5; 10.0 before 10.0.10; 9.0 before 9.0.16 |
| CVE-2021-3048 | 5.9 | Aug 11 | PAN-OS: Invalid URLs in an External Dynamic List (EDL) can Lead to Firewall Outage Affected: 9.0 before 9.0.14; 9.1 before 9.1.9; 10.0 before 10.0.5 |
| CVE-2017-17841 | 5.9 | Jan 10 | Palo Alto Networks PAN-OS 6.1, 7.1, and 8.0.x before 8.0.7, when an interface implements SSL decryption with RSA enabled or hosts a GlobalProtect portal or gateway, might allow… Affected: 6.1.0; 7.1.0; 7.1.1; 7.1.2; 7.1.3; 7.1.4; +18 more |
| CVE-2026-0269 | 5.7 | Jun 10 | PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing Affected: 12.1.0 before 12.1.5; 11.2.0 before 11.2.10; 11.1.0 before 11.1.6-h21; 10.2.0 before 10.2.16-h6 |
| CVE-2025-2182 | 5.6 | Aug 13 | PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK) Affected: 11.2.0 before 11.2.8; 11.1.0 before 11.1.10 |
| CVE-2026-0267 | 5.5 | Jun 10 | GlobalProtect App: Information Exposure Vulnerability on macOS Affected: 6.2.0 before 6.2.8; 6.3.0 before 6.3.3; 6.2.8; 6.2.8; 6.3.3 |
| CVE-2024-2431 | 5.5 | Mar 13 | GlobalProtect App: Local User Can Disable GlobalProtect Affected: 5.1.0 before 5.1.12; 5.2.0 through 5.2.13; 6.0.0 before 6.0.4; 6.1.0 |
| CVE-2022-0021 | 5.5 | Feb 10 | GlobalProtect App: Information Exposure Vulnerability When Using Connect Before Logon Affected: 5.2 before 5.2.9 |
| CVE-2022-0019 | 5.5 | Feb 10 | GlobalProtect App: Insufficiently Protected Credentials Vulnerability on Linux Affected: 5.1 before 5.1.10; 5.2 through 5.2.7; 5.3 before 5.3.2 |
| CVE-2021-3038 | 5.5 | Apr 20 | GlobalProtect App: Windows VPN kernel driver denial of service (DoS) Affected: 5.1.0 before 5.1.8; 5.2.0 before 5.2.4 |
| CVE-2020-2004 | 5.5 | May 13 | GlobalProtect App: Passwords may be logged in clear text while collecting troubleshooting logs Affected: 5.0.0 before 5.0.9; 5.0.0 before 5.0.9; 5.1.0 before 5.1.2; 5.1.0 before 5.1.2 |
| CVE-2020-1976 | 5.5 | Feb 12 | GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability. Affected: 5.0 through 5.0.5 |
| CVE-2019-17435 | 5.5 | Oct 16 | A Local Privilege Escalation vulnerability exists in the GlobalProtect Agent for Windows 5.0.3 and earlier, and GlobalProtect Agent for Windows 4.1.12 and earlier, in which the… Affected: through 5.0.3; through 4.1.12 |
| CVE-2018-9242 | 5.5 | Jul 3 | The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier may allow an attacker to delete files in the system via… Affected: after 6.0.0 through 6.1.20; 7.1.0 through 7.1.16; after 8.0.0 through 8.0.9 |
| CVE-2018-9334 | 5.5 | Jul 3 | The PAN-OS management web interface page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0 may allow an attacker to access the… Affected: after 6.0.0 through 6.1.20; 7.1.0 through 7.1.16; after 8.0.0 through 8.0.8; 8.1.0 |
| CVE-2023-0010 | 5.4 | Jun 14 | PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in Captive Portal Authentication Affected: 10.2 before 10.2.2; 10.1 before 10.1.6; 10.0 before 10.0.11; 9.1 before 9.1.16; 9.0 before 9.0.17; 8.1 before 8.1.24 |
| CVE-2021-3052 | 5.4 | Sep 8 | PAN-OS: Reflected Cross-Site Scripting (XSS) in Web Interface Affected: 9.0 before 9.0.14; 8.1 before 8.1.20; 9.1 before 9.1.10; 10.0 before 10.0.2 |
| CVE-2020-1993 | 5.4 | May 13 | PAN-OS: GlobalProtect Portal PHP session fixation vulnerability Affected: 8.0.*; 7.1.*; 8.1 before 8.1.14; 9.0 before 9.0.8 |
| CVE-2019-1565 | 5.4 | Jan 30 | The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacker that is authenticated in Next… Affected: PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier. |
| CVE-2018-9337 | 5.4 | Jul 3 | The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker… Affected: after 6.0.0 through 6.1.20; 7.1.0 through 7.1.17; after 8.0.0 through 8.0.10; 8.1.0 through 8.1.1 |
| CVE-2018-9335 | 5.4 | Jul 3 | The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject… Affected: after 6.0.0 through 6.1.20; 7.1.0 through 7.1.16; after 8.0.0 through 8.0.9; 8.1.0 through 8.1.1 |
| CVE-2017-5584 | 5.4 | Mar 15 | Cross-site scripting (XSS) vulnerability in the Management Web Interface in Palo Alto Networks PAN-OS 5.1, 6.x before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows… Affected: 5.1; 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; +34 more |
| CVE-2016-2219 | 5.4 | Jul 12 | Cross-site scripting (XSS) vulnerability in the management interface in Palo Alto Networks PAN-OS 7.x before 7.0.8 allows remote authenticated users to inject arbitrary web script… Affected: 7.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +2 more |
| CVE-2025-0136 | 5.3 | May 14 | PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices Affected: 11.1.0 before 11.1.5; 11.0.0 before 11.0.7; 10.2.0 before 10.2.11; 10.1.0 before 10.1.14-h14 |
| CVE-2024-3386 | 5.3 | Apr 10 | PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended Affected: 9.0.0 before 9.0.17-h2; 9.1.0 before 9.1.17; 10.0.0 before 10.0.13; 10.1.0 before 10.1.9-h3; 10.1.0 before 10.1.10; 10.2.0 before 10.2.4-h2; +3 more |
| CVE-2020-1999 | 5.3 | Nov 12 | PAN-OS: Threat signatures are evaded by specifically crafted packets Affected: 7.1.*; 8.0.*; 8.1 before 8.1.17; 9.0 before 9.0.11; 9.1 before 9.1.5 |
| CVE-2020-2039 | 5.3 | Sep 9 | PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload Affected: 9.1 before 9.1.4; 8.1 before 8.1.16; 9.0 before 9.0.10; 10.0 before 10.0.1 |
| CVE-2020-2033 | 5.3 | Jun 10 | GlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookie Affected: 5.0.0 before 5.0.10; 5.1.0 before 5.1.4 |
| CVE-2020-1996 | 5.3 | May 13 | PAN-OS: Panorama management server log injection Affected: 7.1.*; 8.0.*; 8.1 before 8.1.14; 9.0 before 9.0.9 |
| CVE-2017-15943 | 5.3 | Dec 11 | The configuration file import for applications, spyware and vulnerability objects functionality in the web interface in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before… Affected: before 6.1.19; 7.0.0 before 7.0.19; 7.1.0 before 7.1.14 |
| CVE-2024-3388 | 5.0 | Apr 10 | PAN-OS: User Impersonation in GlobalProtect SSL VPN Affected: 8.1.0 before 8.1.26; 9.0.0 before 9.0.17-h4; 9.1.0 before 9.1.17; 10.1.0 before 10.1.11-h4; 10.2.0 before 10.2.7-h3; 11.0.0 before 11.0.3 |
| CVE-2026-0319 | 4.9 | Oct 14 | PAN-OS: Improper Input Handling Vulnerability Affected: 12.2.0 before 12.2.4; 12.1.0 before 12.1.10-h2; 11.2.0 before 11.2.16; 11.1.0 before 11.1.16-h3; 10.2.0 before 10.2.18-h12 |
| CVE-2026-0285 | 4.9 | Jul 9 | PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface Affected: 12.1.0 before 12.1.8; 11.2.0 before 11.2.13; 11.1.0 before 11.1.16; 10.2.0 before 10.2.18-h8 |
| CVE-2024-5917 | 4.9 | Nov 14 | PAN-OS: Server-Side Request Forgery in WildFire Affected: 10.2.0 before 10.2.2; 10.1.0 before 10.1.7 |
| CVE-2024-5911 | 4.9 | Jul 10 | PAN-OS: File Upload Vulnerability in the Panorama Web Interface Affected: 10.2.0 before 10.2.4; 10.1.0 before 10.1.9 |
| CVE-2023-6791 | 4.9 | Dec 13 | PAN-OS: Plaintext Disclosure of External System Integration Credentials Affected: 8.1 before 8.1.24-h1; 9.0 before 9.0.17; 9.1 before 9.1.16; 10.0 before 10.0.12; 10.1 before 10.1.9; 10.2 before 10.2.4; +1 more |
| CVE-2023-38046 | 4.9 | Jul 12 | PAN-OS: Read System Files and Resources During Configuration Commit Affected: 11.0 before 11.0.1; 10.2 before 10.2.4 |
| CVE-2023-0005 | 4.9 | Apr 12 | PAN-OS: Exposure of Sensitive Information Vulnerability Affected: 10.2 before 10.2.3; 10.1 before 10.1.8; 10.0 before 10.0.12; 9.1 before 9.1.15; 9.0 before 9.0.17; 8.1 before 8.1.24 |
| CVE-2021-3045 | 4.9 | Aug 11 | PAN-OS: OS Command Argument Injection in Web Interface Affected: 8.1 before 8.1.19; 9.0 before 9.0.14; 9.1 before 9.1.10 |
| CVE-2020-2031 | 4.9 | Jul 8 | PAN-OS: Integer underflow in the management interface Affected: 9.1 before 9.1.3 |
| CVE-2020-1995 | 4.9 | May 13 | PAN-OS: Management server rasmgr denial of service Affected: 9.1 before 9.1.2 |
| CVE-2026-0266 | 4.8 | Jun 10 | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface Affected: 12.1.0 before 12.1.5; 11.2.0 before 11.2.11; 11.1.0 before 11.1.14; 10.2.0 |
| CVE-2026-0256 | 4.8 | May 13 | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface Affected: 12.1.0 before 12.1.7; 11.2.0 before 11.2.12; 11.1.0 before 11.1.15; 10.2.0 before 10.2.18-h6 |
| CVE-2025-0137 | 4.8 | May 14 | PAN-OS: Improper Neutralization of Input in the Management Web Interface Affected: 11.2.0 before 11.2.5; 11.1.0 before 11.1.8; 10.2.0 before 10.2.13; 10.1.0 before 10.1.14-h14 |
| CVE-2024-5920 | 4.8 | Nov 14 | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator Affected: 11.1.0 before 11.1.4; 11.0.0 before 11.0.6; 10.2.0 before 10.2.7-h24; 10.1.0 before 10.1.14 |
| CVE-2024-0007 | 4.8 | Feb 14 | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface Affected: 8.1 before 8.1.24-h1; 8.1 before 8.1.25; 9.0 before 9.0.17; 9.1 before 9.1.16; 10.0 before 10.0.11; 10.1 before 10.1.6 |
| CVE-2023-6789 | 4.8 | Dec 13 | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface Affected: 8.1 before 8.1.26; 9.0 before 9.0.17-h4; 9.1 before 9.1.17; 10.0 through All; 10.1 before 10.1.11; 10.2 before 10.2.5; +1 more |
| CVE-2023-0007 | 4.8 | May 10 | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Panorama Web Interface Affected: 10.0 before 10.0.7; 9.1 before 9.1.16; 9.0 before 9.0.17; 8.1 before 8.1.25 |
| CVE-2020-1982 | 4.8 | Jul 8 | PAN-OS: TLS 1.0 usage for certain communications with Palo Alto Networks cloud delivered services Affected: 8.0.*; 9.1 before 9.1.3; 9.0 before 9.0.9; 8.1 before 8.1.15 |
| CVE-2024-9471 | 4.7 | Oct 9 | PAN-OS: Privilege Escalation (PE) Vulnerability in XML API Affected: 11.0.0 before 11.0.3; 10.1.0 before 10.1.11; 10.2.0 before 10.2.8; 9.1; 9.0 |