Palo Alto Networks

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Palo Alto Networks product.

RSS Feeds for Palo Alto Networks security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Palo Alto Networks products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Palo Alto Networks Sorted by Most Security Vulnerabilities since 2018

Palo Alto Networks PAN-OS186 vulnerabilities
PAN-OS is the software that runs all Palo Alto Networks next-generation firewalls.

Palo Alto Networks Globalprotect30 vulnerabilities

Palo Alto Networks Prisma Access20 vulnerabilities

Palo Alto Networks Expedition14 vulnerabilities

Palo Alto Networks Cortex Xdr Agent9 vulnerabilities

Palo Alto Networks Prisma Access Agent8 vulnerabilities

Palo Alto Networks Cortex Xsoar8 vulnerabilities

Palo Alto Networks Prisma Browser7 vulnerabilities

Palo Alto Networks Prisma Cloud4 vulnerabilities

Palo Alto Networks Globalprotect App4 vulnerabilities

Palo Alto Networks Cortex Xdr Broker Vm3 vulnerabilities

Palo Alto Networks Trust Protection Foundation3 vulnerabilities

Palo Alto Networks Prisma Sd Wan Ion2 vulnerabilities

Palo Alto Networks Cloud Ngfw2 vulnerabilities

Palo Alto Networks Globalprotect Uwp App1 vulnerability

Palo Alto Networks Cortex Xsoar Microsoft Teams Marketplace1 vulnerability

Palo Alto Networks Cortex Xsoar Commvaultsecurityiq Marketplace1 vulnerability

Palo Alto Networks Cortex Xsoar Commonscripts1 vulnerability

Palo Alto Networks Cortex Xsiam Microsoft Teams Marketplace1 vulnerability

Palo Alto Networks Cortex Xsiam Commvaultsecurityiq Marketplace1 vulnerability

Palo Alto Networks Chronosphere Chronocollector1 vulnerability

Palo Alto Networks Broker Vm1 vulnerability

Palo Alto Networks Autonomous Digital Experience Manager1 vulnerability

Palo Alto Networks Wildfire Wf 500 And Wf 500 B1 vulnerability

By the Year

In 2026 there have been 58 vulnerabilities in Palo Alto Networks. Last year, in 2025 Palo Alto Networks had 32 security vulnerabilities published. That is, 26 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	58	0.00
2025	32	6.12
2024	50	6.50
2023	15	5.39
2022	9	6.47
2021	30	6.56
2020	61	6.83
2019	24	6.79
2018	11	5.66

It may take a day or so for new Palo Alto Networks vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Palo Alto Networks Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-0275	Jul 09, 2026	PrivEsc in Palo Alto Prisma Browser macOS via Local Admin File Access A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local filesystem to perform actions on the device with root privileges. This issue only affects Prisma® Browser on macOS.	Prisma Browser
CVE-2026-0276	Jul 09, 2026	Cortex XDR Broker VM PrivEsc to Root via Local Auth A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user.	Cortex Xdr Broker Vm
CVE-2026-0277	Jul 09, 2026	Improper Cert Validation in Prisma Access Agent iOS Enables MitM An improper certificate validation vulnerability in the Prisma® Access Agent for iOS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. The Prisma Access Agent on Windows, macOS, Linux, Android and ChromeOS are not affected.	Prisma Access Agent
CVE-2026-0278	Jul 09, 2026	Prisma Access Agent DLP Bypass via Local User on Windows Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected.	Prisma Access Agent
CVE-2026-0279	Jul 09, 2026	XSS in PAN-OS User-ID Portal & GlobalProtect Multiple cross site scripting vulnerabilities in the User-ID Authentication Portal (aka Captive Portal) service, GlobalProtect gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malicious JavaScript payload. The security risk posed by this issue is minimized when the management interface and access to the User-ID Authentication Portal is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW is not affected by this vulnerability.	PAN-OS Prisma Access
CVE-2026-0280	Jul 09, 2026	PAN-OS IPv6 Stack Bypass in Dataplane Enables Policy Evasion An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services. Cloud NGFW and Panorama are not impacted by this vulnerability.	PAN-OS Prisma Access
CVE-2026-0281	Jul 09, 2026	Palo Alto PAN-OS Web Session Token Disclosure via Malicious Link An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.	PAN-OS
CVE-2026-0282	Jul 09, 2026	Unauthenticated File Deletion via PAN-OS Web UI A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory. The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.	PAN-OS
CVE-2026-0283	Jul 09, 2026	Auth Bypass in Palo Alto PAN-OS LSVPN An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.	PAN-OS
CVE-2026-0284	Jul 09, 2026	XML Injection in LSVPN Component of Palo Alto PAN-OS An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.	PAN-OS
CVE-2026-0285	Jul 09, 2026	SSRF in PAN-OS Management Web Interface A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.	PAN-OS
CVE-2026-0286	Jul 09, 2026	Command Injection in Palo Alto PANOS Admin Interface A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access® are not impacted by this vulnerability.	PAN-OS
CVE-2026-0287	Jul 09, 2026	Unauthenticated DoS in PAN-OS Data Plane via Crafted Traffic Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Panorama is not impacted by these vulnerabilities.	PAN-OS Cloud Ngfw Prisma Access And others...
CVE-2026-0288	Jul 08, 2026	Buffer Overflows in Palo Alto User-ID TSA Cause DoS/RCE Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server Agent connectivity is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://docs.paloaltonetworks.com/ngfw/help/10-2/user-identification/device-user-identification-terminal-services-agents#:~:text=To%20minimize%20security%20risk%2C%20restrict%20TS%20Agent%20connectivity%20to%20trusted%20internal%20IP%20addresses%20only. . Panorama is not impacted by this vulnerability.	PAN-OS Prisma Access
CVE-2026-0274	Jun 10, 2026	Improper credential validation in CommvaultSecurityIQ XSOAR integration An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.	Cortex Xsiam Commvaultsecurityiq Marketplace Cortex Xsoar Commvaultsecurityiq Marketplace
CVE-2026-0273	Jun 10, 2026	PAN-OS Command Injection Escalation to Root via CLI/Web UI A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.	PAN-OS
CVE-2026-0272	Jun 10, 2026	PALO ALTO PAN-OS CLI PrivEsc (CVE-2026-0272) A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.	PAN-OS
CVE-2026-0271	Jun 10, 2026	Linux PE via Prisma Access Agent (Palo Alto) A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux devices enables a local user to execute code with elevated privileges. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.	Prisma Access Agent
CVE-2026-0270	Jun 10, 2026	Path traversal in Palo Alto Cortex XSOAR (Linux) allows arbitrary file write A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.	Cortex Xsoar
CVE-2026-0269	Jun 10, 2026	PAN-OS Tunnel MemCorrupt Reboot Exploit (Authenticated) A memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.	PAN-OS
CVE-2026-0268	Jun 10, 2026	Prisma Access Agent Linux VPN Bypass for Local Attacker A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.	Prisma Access Agent
CVE-2026-0267	Jun 10, 2026	GlobalProtect macOS Passcode Disclosure Vulnerability An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the GlobalProtect app. After the passcode is known, the user can perform these actions even if the GlobalProtect app configuration would not normally permit them to do so.	Globalprotect App
CVE-2026-0266	Jun 10, 2026	XSS in Palo Alto Networks PAN-OS UI Captures Authenticated Admin Payloads A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.	PAN-OS
CVE-2026-0243	May 13, 2026	DoS via crafted IPv6 packet on Palo Alto Prisma SD-WAN ION A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to cause a system disruption by sending a specially crafted IPv6 packet.	Prisma Sd Wan Ion
CVE-2026-0248	May 13, 2026	Improper Cert Validation in Prisma Access Agent for Android Enables MitM An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information. The Prisma Access Agent on macOS, Windows, Linux and iOS are not affected.	Prisma Access Agent
CVE-2026-0242	May 13, 2026	SQLi in Trust Protection Foundation (TPF) enabling admin takeover A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform.	Trust Protection Foundation
CVE-2026-0244	May 13, 2026	Improper Cert Validation in Palo Alto Networks Prisma SD-WAN ION Allows MitM An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.	Prisma Sd Wan Ion
CVE-2026-0241	May 13, 2026	Incorrect Auth Bypass in Palo Alto Trust Protection Foundation Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.	Trust Protection Foundation
CVE-2026-0245	May 13, 2026	Prisma Access Agent Local User Info Disclosure Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials. The Prisma Access Agent on Linux, ChromeOS, Android, and iOS are not affected.	Prisma Access Agent
CVE-2026-0240	May 13, 2026	TPF CVE-2026-0240: Authenticated InfoDisclosure & PrivEsc via Vault An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.	Trust Protection Foundation
CVE-2026-0246	May 13, 2026	Prisma Access Agent Priv Escal to Root / SYSTEM (CVE-2026-0246) A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts. The Prisma Access Agent on iOS, Android and Chrome OS are not affected.	Prisma Access Agent
CVE-2026-0247	May 13, 2026	Auth Bypass in Prisma Access Agent Endpoint DLP Component Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged operations.	Prisma Access Agent
CVE-2026-0249	May 13, 2026	GlobalProtect CVE-2026-0249 Improper Cert Validation Traffic Intercept Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software. The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.	Globalprotect App
CVE-2026-0239	May 13, 2026	Chronocollector Unauth Info Disclosure (CVE-2026-0239) An information disclosure vulnerability in the Chronosphere Chronocollector enables an unauthenticated attacker with network access to the collector service to retrieve sensitive information.	Chronosphere Chronocollector
CVE-2026-0250	May 13, 2026	Buffer Overflow in Palo Alto GlobalProtect Enables Code Exec (CVE-2026-0250) A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the processing of requests and responses exchanged between Portal and Gateway. The GlobalProtect app on iOS is not affected.	Globalprotect App Globalprotect Uwp App
CVE-2026-0238	May 13, 2026	Authenticated Admin Injection in Palo Alto Broker VM A vulnerability in Palo Alto Networks Broker VM allows an authenticated administrator to inject arbitrary content into certain Broker VM fields.	Broker Vm
CVE-2026-0251	May 13, 2026	Palo Alto GlobalProtect Local Priv Escal to SYSTEM/ROOT Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect app on iOS, Android, Chrome OS and GlobalProtect UWP app are not affected.	Globalprotect App
CVE-2026-0256	May 13, 2026	PAN-OS Stored XSS via Web Interface on PA-Series/VM-Series & Panorama A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.	PAN-OS
CVE-2026-0257	May 13, 2026	Auth Bypass in PAN-OS GlobalProtect Portal/Gateway Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. Panorama and Cloud NGFW are not impacted by these issues.	PAN-OS Prisma Access
CVE-2026-0235	May 13, 2026	Race Condition in Prisma Browser Allows Local User to Bypass Policies A race condition vulnerability in Palo Alto Networks Prisma® Browser enables a locally authenticated non-admin user to bypass certain access and data control policies.	Prisma Browser
CVE-2026-0258	May 13, 2026	PAN-OS SSRF via IKEv2 Unauthenticated Attack A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition. Panorama, Cloud NGFW and Prisma® Access are not impacted by these vulnerabilities.	PAN-OS
CVE-2026-0259	May 13, 2026	Arbitrary File Read/Deletion in Palo Alto Networks WildFire WF-500 An arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire® WF-500 and WF-500-B appliances enables users to read sensitive information and delete arbitrary files. This vulnerability affects WF-500 and WF-500-B appliances running in the default non-FIPS configuration mode. The WildFire Appliance (WF-500, WF-500-B) software update is now available to customers that use the WildFire Appliance (WF-500, WF-500-B) for on-premise sandboxing. Please note that customers using the WildFire Public cloud service are NOT impacted by this vulnerability.	Wildfire Wf 500 And Wf 500 B
CVE-2026-0261	May 13, 2026	Palo Alto PAN-OS Root CLI Command Injection CVE-2026-0261 Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS® software enable an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access® are not impacted by these vulnerabilities.	PAN-OS
CVE-2026-0236	May 13, 2026	Code Injection via AppleScript in Palo Alto Prisma Browser (macOS) A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser.	Prisma Browser
CVE-2026-0262	May 13, 2026	DoS via Crafted Traffic in Palo Alto PAN-OS Network OS Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic. Panorama and Cloud NGFW are not impacted by these vulnerabilities.	PAN-OS Prisma Access
CVE-2026-0237	May 13, 2026	Palo Alto Networks Prisma Browser Auth CmdInv via AutoBr (CVE-2026-0237) An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.	Prisma Browser
CVE-2026-0263	May 13, 2026	Pan-OS IKEv2 Buffer Overflow Enables RCE A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition. Panorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.	PAN-OS
CVE-2026-0264	May 13, 2026	PAN-OS DNS Buffer Overflow DoS / Remote Code Exec A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Prisma Access) or potentially execute arbitrary code by sending specially crafted network traffic (PA-Series hardware only). Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.	PAN-OS
CVE-2026-0265	May 13, 2026	PAN-OS CAS Auth Bypass (CVE-2026-0265) An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled. The risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used. The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access® are not impacted by this vulnerability.	PAN-OS
CVE-2026-0300	May 06, 2026	PAN-OS User-ID Auth Captive Po Buffer Overflow Root Code Exec A buffer overflow vulnerability in the User-ID Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. The risk of this issue is greatly reduced if you secure access to the User-ID Authentication Portal per the best practice guidelines https://knowledgebase.paloaltonetworks.com/KCSArticleDetail by restricting access to only trusted internal IP addresses. Prisma Access, Cloud NGFW and Panorama appliances are not impacted by this vulnerability.	PAN-OS