PA
Network Security
PAN-OS
On CISA KEVExploited in the wildRansomware-linked
306
CVEs
17
On KEV
10.0
Max CVSS
9
New 30D
Severity mix
Critical 28High 121Medium 117Low 19
Watch
Add PAN-OS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-0124 | 3.8 | Apr 11 | PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface Affected: 11.2.0 before 11.2.1; 11.1.0 before 11.1.5; 11.0.0 before 11.0.6; 10.2.0 before 10.2.10; 10.1.0 before 10.1.14-h11 |
| CVE-2025-4227 | 3.5 | Jun 13 | GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement Affected: 6.0.0 before 6.2.8; 6.0.0 before 6.2.8; 6.3.0 before 6.3.3; 6.3.0 before 6.3.3 |
| CVE-2025-0135 | 3.3 | May 14 | GlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect App Affected: 6.0.0 before 6.2.8; 6.3.0 before 6.3.3 |
| CVE-2020-2048 | 3.3 | Nov 12 | PAN-OS: System proxy passwords may be logged in clear text while viewing system state Affected: 8.1 before 8.1.17; 9.0 before 9.0.11; 9.1 before 9.1.2 |
| CVE-2020-2044 | 3.3 | Sep 9 | PAN-OS: Passwords may be logged in clear text while storing operational command (op command) history Affected: 8.0.*; 8.1 before 8.1.16; 9.0 before 9.0.10; 9.1 before 9.1.3 |
| CVE-2020-2043 | 3.3 | Sep 9 | PAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logs Affected: 8.1 before 8.1.16; 9.0 before 9.0.10; 9.1 before 9.1.4 |
| CVE-2020-1987 | 3.3 | Apr 8 | Global Protect Agent: VPN cookie local information disclosure Affected: 5.0 before 5.0.9; 5.1 before 5.1.1 |
| CVE-2021-3047 | 3.1 | Aug 11 | PAN-OS: Weak Cryptography Used in Web Interface Authentication Affected: 8.1 before 8.1.19; 9.0 before 9.0.14; 10.0 before 10.0.4; 9.1 before 9.1.10 |
| CVE-2020-2035 | 3.0 | Aug 12 | PAN-OS: URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions Affected: 8.1.*; 9.0.*; 9.1.*; 10.0.*; 10.1.* |
| CVE-2025-4614 | 2.7 | Oct 9 | PAN-OS: Session Token Disclosure Vulnerability Affected: 11.2.0 before 11.2.8; 11.1.0 before 11.1.12; 10.2.0 before 10.2.17 |
| CVE-2025-0133 | 2.7 | May 14 | PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal Affected: 11.2.0 before 11.2.7; 11.1.0 before 11.1.6-h14; 10.2.0 before 10.2.16-h1; 10.1.0 |
| CVE-2024-2433 | 2.7 | Mar 13 | PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss Affected: 9.0 before 9.0.17-h4; 9.1 before 9.1.17; 10.1 before 10.1.12; 10.2 before 10.2.8; 11.0 before 11.0.3 |
| CVE-2023-6793 | 2.7 | Dec 13 | PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator Affected: 9.0 before 9.0.17-h4; 9.1 before 9.1.17; 10.0 through All; 10.1 before 10.1.11; 10.2 before 10.2.5; 11.0 before 11.0.2 |
| CVE-2019-1573 | 2.5 | Apr 9 | Information Disclosure in GlobalProtect Agent Affected: through 4.1.0; through 4.1.10 |
| CVE-2021-3037 | 2.3 | Apr 20 | PAN-OS: Secrets for scheduled configuration exports are logged in system logs Affected: 8.1 before 8.1.19; 9.0 before 9.0.13; 9.1 before 9.1.4 |
| CVE-2026-0228 | 1.3 | Feb 11 | PAN-OS: Improper Validation of Terminal Server Agent Certificate Affected: 11.2.0 before 11.2.8; 11.1.0 before 11.1.11; 10.2.0 before 10.2.17 |
| CVE-2026-0317 | 1.2 | Oct 14 | PAN-OS: Denial of Service Vulnerability Affected: 12.2.0 before 12.2.4; 12.1.0 before 12.1.10-h2; 11.2.0 before 11.2.16; 11.1.0 before 11.1.16-h3 |
| CVE-2026-0316 | 1.1 | Oct 14 | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability Affected: 12.2.0 before 12.2.4; 12.1.0 before 12.1.10-h2; 11.2.0 before 11.2.16; 11.1.0 before 11.1.16-h3 |
| CVE-2026-0308 | 1.1 | Sep 10 | PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface Affected: 12.1.0 before 12.1.10; 11.2.0 before 11.2.13-h2; 11.1.0 before 11.1.16-h2 |
Showing 19