# cve.now: Palo Alto Networks The newest entries naming Palo Alto Networks as an affected vendor (up to 200), of 364 in all, 14 known exploited. Older ones are in the full catalog at https://cve.now/latest.md. - [CVE-2026-45165](https://cve.now/CVE-2026-45165.md): Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API (CVSS 8.6) - [CVE-2026-0311](https://cve.now/CVE-2026-0311.md): Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability (CVSS 1.1) - [CVE-2026-0312](https://cve.now/CVE-2026-0312.md): Checkov by Prisma Cloud: Path Traversal Vulnerabilities (CVSS 4.3) - [CVE-2026-0313](https://cve.now/CVE-2026-0313.md): Cortex XSOAR: OS Command Injection Vulnerability (CVSS 6.1) - [CVE-2026-0314](https://cve.now/CVE-2026-0314.md): GlobalProtect App: Local Denial of Service (DoS) on Windows (CVSS 4.3) - [CVE-2026-0315](https://cve.now/CVE-2026-0315.md): GlobalProtect App: Local Privilege Escalation Vulnerability on macOS (CVSS 5.9) - [CVE-2026-0316](https://cve.now/CVE-2026-0316.md): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability (CVSS 1.1) - [CVE-2026-0317](https://cve.now/CVE-2026-0317.md): PAN-OS: Denial of Service Vulnerability (CVSS 1.2) - [CVE-2026-0318](https://cve.now/CVE-2026-0318.md): PAN-OS: Denial of Service (DoS) on Panorama (CVSS 4.6) - [CVE-2026-0319](https://cve.now/CVE-2026-0319.md): PAN-OS: Improper Input Handling Vulnerability (CVSS 4.9) - [CVE-2026-0320](https://cve.now/CVE-2026-0320.md): PAN-OS: Authenticated Admin Command Injection Vulnerability (CVSS 6.1) - [CVE-2026-0321](https://cve.now/CVE-2026-0321.md): PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services (CVSS 6.6) - [CVE-2026-0322](https://cve.now/CVE-2026-0322.md): PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface (CVSS 8.6, KEV) - [CVE-2026-0302](https://cve.now/CVE-2026-0302.md): Checkov by Prisma Cloud: OS Command Injection Vulnerability (CVSS 1.1) - [CVE-2026-0303](https://cve.now/CVE-2026-0303.md): Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File (CVSS 2.4) - [CVE-2026-0304](https://cve.now/CVE-2026-0304.md): Cortex XDR Broker VM: Privilege Escalation Vulnerability (CVSS 4.8) - [CVE-2026-0305](https://cve.now/CVE-2026-0305.md): Prisma Access Agent: Information Disclosure Vulnerability on Linux (CVSS 4.3) - [CVE-2026-0306](https://cve.now/CVE-2026-0306.md): Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows (CVSS 5.8) - [CVE-2026-0307](https://cve.now/CVE-2026-0307.md): GlobalProtect App: Local Privilege Escalation Vulnerabilities (CVSS 5.9) - [CVE-2026-0308](https://cve.now/CVE-2026-0308.md): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (CVSS 1.1) - [CVE-2026-0309](https://cve.now/CVE-2026-0309.md): PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration (CVSS 4.0) - [CVE-2026-0310](https://cve.now/CVE-2026-0310.md): PAN-OS: Buffer Overflow Vulnerability via XML Processing (CVSS 7.2) - [CVE-2026-0301](https://cve.now/CVE-2026-0301.md): PAN-OS: Information Disclosure Vulnerability in URL Filtering (CVSS 1.7) - [CVE-2026-0299](https://cve.now/CVE-2026-0299.md): GlobalProtect App: Local Privilege Escalation Vulnerabilities (CVSS 5.9) - [CVE-2026-0298](https://cve.now/CVE-2026-0298.md): GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP) (CVSS 5.2) - [CVE-2026-0297](https://cve.now/CVE-2026-0297.md): GlobalProtect App: Buffer Overflow Vulnerability during UDP Tunnel Handshake (CVSS 5.2) - [CVE-2026-0296](https://cve.now/CVE-2026-0296.md): GlobalProtect App: Improper Certificate Validation Bypass Vulnerability (CVSS 4.5) - [CVE-2026-0295](https://cve.now/CVE-2026-0295.md): GlobalProtect App: Local Privilege Escalation via Race Condition on macOS (CVSS 4.1) - [CVE-2026-0294](https://cve.now/CVE-2026-0294.md): Prisma Access Agent: Local Privilege Escalation (CVSS 6.0) - [CVE-2026-0293](https://cve.now/CVE-2026-0293.md): Prisma Access Agent: Anti-Tamper Protection Bypass on Windows (CVSS 5.6) - [CVE-2026-0292](https://cve.now/CVE-2026-0292.md): Prisma Access Agent: Local Security Inspection Bypass Vulnerability on Windows (CVSS 2.1) - [CVE-2026-0291](https://cve.now/CVE-2026-0291.md): Prisma Access Agent: Authenticated Limited File Deletion on Linux (CVSS 1.1) - [CVE-2026-0290](https://cve.now/CVE-2026-0290.md): Prisma Browser: Sensitive Information Disclosure Vulnerability (CVSS 0.5) - [CVE-2026-0289](https://cve.now/CVE-2026-0289.md): Prisma Browser: Inappropriate Implementation in Account Protection (CVSS 0.5) - [CVE-2026-0275](https://cve.now/CVE-2026-0275.md): Prisma Browser: Local Privilege Escalation on macOS (CVSS 2.0) - [CVE-2026-0276](https://cve.now/CVE-2026-0276.md): Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability (CVSS 1.1) - [CVE-2026-0277](https://cve.now/CVE-2026-0277.md): Prisma Access Agent: Improper Certificate Validation on iOS (CVSS 5.7) - [CVE-2026-0278](https://cve.now/CVE-2026-0278.md): Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows (CVSS 5.8) - [CVE-2026-0279](https://cve.now/CVE-2026-0279.md): PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities (CVSS 1.3) - [CVE-2026-0280](https://cve.now/CVE-2026-0280.md): PAN-OS: IPv6 Firewall Policy Bypass (CVSS 1.7) - [CVE-2026-0281](https://cve.now/CVE-2026-0281.md): PAN-OS: Information Disclosure Vulnerability in Management Web Interface (CVSS 2.1) - [CVE-2026-0282](https://cve.now/CVE-2026-0282.md): PAN-OS: File Deletion Vulnerability in Management Web Interface (CVSS 2.7) - [CVE-2026-0283](https://cve.now/CVE-2026-0283.md): PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN) (CVSS 4.5) - [CVE-2026-0284](https://cve.now/CVE-2026-0284.md): PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) (CVSS 4.7) - [CVE-2026-0285](https://cve.now/CVE-2026-0285.md): PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface (CVSS 4.7) - [CVE-2026-0286](https://cve.now/CVE-2026-0286.md): PAN-OS: Authenticated Command Injection in CLI (CVSS 6.0) - [CVE-2026-0287](https://cve.now/CVE-2026-0287.md): PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing (CVSS 6.6) - [CVE-2026-0288](https://cve.now/CVE-2026-0288.md): PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent (CVSS 7.2) - [CVE-2026-0274](https://cve.now/CVE-2026-0274.md): Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration (CVSS 8.1) - [CVE-2026-0273](https://cve.now/CVE-2026-0273.md): PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI (CVSS 6.1) - [CVE-2026-0272](https://cve.now/CVE-2026-0272.md): PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI) (CVSS 6.0) - [CVE-2026-0271](https://cve.now/CVE-2026-0271.md): Prisma Access Agent: Local Privilege Escalation by Authorized Users (CVSS 5.9) - [CVE-2026-0270](https://cve.now/CVE-2026-0270.md): Cortex XSOAR: Path Traversal Vulnerability (CVSS 4.8) - [CVE-2026-0269](https://cve.now/CVE-2026-0269.md): PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing (CVSS 4.6) - [CVE-2026-0268](https://cve.now/CVE-2026-0268.md): Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux (CVSS 4.4) - [CVE-2026-0267](https://cve.now/CVE-2026-0267.md): GlobalProtect App: Information Exposure Vulnerability on macOS (CVSS 4.4) - [CVE-2026-0266](https://cve.now/CVE-2026-0266.md): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (CVSS 1.1) - [CVE-2026-0243](https://cve.now/CVE-2026-0243.md): Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through IPv6 Crafted Packet (CVSS 4.9) - [CVE-2026-0248](https://cve.now/CVE-2026-0248.md): Prisma Access Agent: Improper Certificate Validation Vulnerability (CVSS 6.2) - [CVE-2026-0242](https://cve.now/CVE-2026-0242.md): Trust Protection Foundation: SQL Injection Vulnerability (CVSS 6.1) - [CVE-2026-0244](https://cve.now/CVE-2026-0244.md): Prisma SD-WAN: Improper Certificate Validation Vulnerability (CVSS 5.2) - [CVE-2026-0241](https://cve.now/CVE-2026-0241.md): Trust Protection Foundation: Multiple Authorization Bypass Vulnerabilities (CVSS 5.1) - [CVE-2026-0245](https://cve.now/CVE-2026-0245.md): Prisma Access Agent: Information Disclosure Vulnerabilities (CVSS 4.3) - [CVE-2026-0240](https://cve.now/CVE-2026-0240.md): Trust Protection Foundation: Sensitive Information Disclosure Vulnerability (CVSS 4.5) - [CVE-2026-0246](https://cve.now/CVE-2026-0246.md): Prisma Access Agent: Local Privilege Escalation Vulnerability (CVSS 5.9) - [CVE-2026-0247](https://cve.now/CVE-2026-0247.md): Prisma Access Agent Endpoint DLP: Authorization Bypass Vulnerabilities (CVSS 5.9) - [CVE-2026-0249](https://cve.now/CVE-2026-0249.md): GlobalProtect App: Certificate Validation Bypass Vulnerabilities (CVSS 4.9) - [CVE-2026-0239](https://cve.now/CVE-2026-0239.md): Chronosphere Chronocollector Information Disclosure Vulnerability (CVSS 4.9) - [CVE-2026-0250](https://cve.now/CVE-2026-0250.md): GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway (CVSS 5.2) - [CVE-2026-0238](https://cve.now/CVE-2026-0238.md): Broker VM: Improper Input Validation in Broker VM Certificate and Key Fields (CVSS 1.1) - [CVE-2026-0251](https://cve.now/CVE-2026-0251.md): GlobalProtect App: Local Privilege Escalation Vulnerabilities (CVSS 5.9) - [CVE-2026-0256](https://cve.now/CVE-2026-0256.md): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (CVSS 4.4) - [CVE-2026-0257](https://cve.now/CVE-2026-0257.md): PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities (CVSS 7.8, KEV) - [CVE-2026-0235](https://cve.now/CVE-2026-0235.md): Prisma Browser: Access and Data Rule Bypass (CVSS 5.8) - [CVE-2026-0258](https://cve.now/CVE-2026-0258.md): PAN-OS: Server-Side Request Forgery (SSRF) in IKEv2 Certificate URL Fetching (CVSS 4.8) - [CVE-2026-0259](https://cve.now/CVE-2026-0259.md): WildFire WF-500 and WF-500-B: Arbitrary File Read and Delete Vulnerability in WildFire Appliance (WF-500, WF-500-B) (CVSS 5.0) - [CVE-2026-0261](https://cve.now/CVE-2026-0261.md): PAN-OS: Authenticated Admin Command Injection Vulnerability (CVSS 6.1) - [CVE-2026-0236](https://cve.now/CVE-2026-0236.md): Prisma Browser: Code Injection Enables Security Controls Bypass (CVSS 7.3) - [CVE-2026-0262](https://cve.now/CVE-2026-0262.md): PAN-OS: Denial of Service Vulnerabilities in Network Traffic Parsing (CVSS 6.6) - [CVE-2026-0237](https://cve.now/CVE-2026-0237.md): Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass (CVSS 7.3) - [CVE-2026-0263](https://cve.now/CVE-2026-0263.md): PAN-OS: Remote Code Execution (RCE) in IKEv2 Processing (CVSS 7.2) - [CVE-2026-0264](https://cve.now/CVE-2026-0264.md): PAN-OS: Heap-Based Buffer Overflow in DNS Proxy and DNS Server Allows Unauthenticated Remote Code Execution (CVSS 7.2) - [CVE-2026-0265](https://cve.now/CVE-2026-0265.md): PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled (CVSS 7.2) - [CVE-2026-0300](https://cve.now/CVE-2026-0300.md): PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal (CVSS 9.3, KEV) - [CVE-2026-0232](https://cve.now/CVE-2026-0232.md): Cortex XDR Agent: Local Administrator can disable the agent on Windows (CVSS 4.0) - [CVE-2026-0233](https://cve.now/CVE-2026-0233.md): Autonomous Digital Experience Manager: Improper validation of ADEM certificate (CVSS 2.0) - [CVE-2026-0234](https://cve.now/CVE-2026-0234.md): Cortex XSOAR: Improper Verification of Cryptographic Signature in Microsoft Teams integration (CVSS 7.2) - [CVE-2026-0231](https://cve.now/CVE-2026-0231.md): Cortex XDR Broker VM: Sensitive Information Disclosure Vulnerability (CVSS 5.7) - [CVE-2026-0230](https://cve.now/CVE-2026-0230.md): Cortex XDR Agent: Local Administrator can disable the agent on macOS (CVSS 4.0) - [CVE-2026-0229](https://cve.now/CVE-2026-0229.md): PAN-OS: Denial of Service in Advanced DNS Security Feature (CVSS 6.6) - [CVE-2026-0228](https://cve.now/CVE-2026-0228.md): PAN-OS: Improper Validation of Terminal Server Agent Certificate (CVSS 1.3) - [CVE-2026-0227](https://cve.now/CVE-2026-0227.md): PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway and Portal (CVSS 6.6) - [CVE-2025-4618](https://cve.now/CVE-2025-4618.md): Prisma Browser: Sensitive Information Disclosure Vulnerability in Prisma Browser (CVSS 4.4) - [CVE-2025-4617](https://cve.now/CVE-2025-4617.md): Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browser (CVSS 1.1) - [CVE-2025-4616](https://cve.now/CVE-2025-4616.md): Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser (CVSS 1.1) - [CVE-2025-4619](https://cve.now/CVE-2025-4619.md): PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Packets (CVSS 6.6) - [CVE-2025-4615](https://cve.now/CVE-2025-4615.md): PAN-OS: Improper Neutralization of Input in the Management Web Interface (CVSS 5.4) - [CVE-2025-4614](https://cve.now/CVE-2025-4614.md): PAN-OS: Session Token Disclosure Vulnerability (CVSS 4.8) - [CVE-2025-4234](https://cve.now/CVE-2025-4234.md): Cortex XDR Microsoft 365 Defender Pack: Cleartext Exposure of Credentials (CVSS 2.4) - [CVE-2025-4235](https://cve.now/CVE-2025-4235.md): User-ID Credential Agent: Cleartext Exposure of Service Account password (CVSS 7.2) - [CVE-2025-2184](https://cve.now/CVE-2025-2184.md): Cortex XDR Broker VM: Secrets Shared Across Multiple Broker VM Images (CVSS 5.3) - [CVE-2025-2183](https://cve.now/CVE-2025-2183.md): GlobalProtect App: Improper Certificate Validation Leads to Privilege Escalation (CVSS 5.3) - [CVE-2025-2182](https://cve.now/CVE-2025-2182.md): PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK) (CVSS 5.6) - [CVE-2025-2181](https://cve.now/CVE-2025-2181.md): Checkov by Prisma Cloud: Cleartext Exposure of Credentials (CVSS 5.9) - [CVE-2025-2180](https://cve.now/CVE-2025-2180.md): Checkov by Prisma Cloud: Unsafe Deserialization of Terraform Files Allows Code Execution (CVSS 4.8) - [CVE-2025-2179](https://cve.now/CVE-2025-2179.md): GlobalProtect App: Non Admin User Can Disable the GlobalProtect App (CVSS 6.8) - [CVE-2025-0141](https://cve.now/CVE-2025-0141.md): GlobalProtect App: Privilege Escalation (PE) Vulnerability (CVSS 8.4) - [CVE-2025-0140](https://cve.now/CVE-2025-0140.md): GlobalProtect App: Non Admin User Can Disable the GlobalProtect App (CVSS 6.8) - [CVE-2025-0139](https://cve.now/CVE-2025-0139.md): Autonomous Digital Experience Manager: Privilege Escalation (PE) Vulnerability (CVSS 6.3) - [CVE-2025-4227](https://cve.now/CVE-2025-4227.md): GlobalProtect App: Interception in Endpoint Traffic Policy Enforcement (CVSS 1.0) - [CVE-2025-4229](https://cve.now/CVE-2025-4229.md): PAN-OS: Traffic Information Disclosure Vulnerability (CVSS 6.0) - [CVE-2025-4228](https://cve.now/CVE-2025-4228.md): Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability (CVSS 4.6) - [CVE-2025-4230](https://cve.now/CVE-2025-4230.md): PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI (CVSS 8.4) - [CVE-2025-4231](https://cve.now/CVE-2025-4231.md): PAN-OS: Authenticated Admin Command Injection Vulnerability in the Management Web Interface (CVSS 8.6) - [CVE-2025-4232](https://cve.now/CVE-2025-4232.md): GlobalProtect: Authenticated Code Injection Through Wildcard on macOS (CVSS 8.5) - [CVE-2025-4233](https://cve.now/CVE-2025-4233.md): Prisma Access Browser: Inappropriate implementation in Cache (CVSS 5.1) - [CVE-2025-0136](https://cve.now/CVE-2025-0136.md): PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices (CVSS 5.3) - [CVE-2025-0138](https://cve.now/CVE-2025-0138.md): Prisma Cloud Compute Edition: Insufficient Session Expiration Vulnerability in the Web Interface (CVSS 2.0) - [CVE-2025-0137](https://cve.now/CVE-2025-0137.md): PAN-OS: Improper Neutralization of Input in the Management Web Interface (CVSS 4.8) - [CVE-2025-0135](https://cve.now/CVE-2025-0135.md): GlobalProtect App on macOS: Non Admin User Can Disable the GlobalProtect App (CVSS 5.2) - [CVE-2025-0134](https://cve.now/CVE-2025-0134.md): Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM (CVSS 6.5) - [CVE-2025-0133](https://cve.now/CVE-2025-0133.md): PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Gateway and Portal (CVSS 1.2) - [CVE-2025-0132](https://cve.now/CVE-2025-0132.md): Cortex XDR Broker VM: Unauthenticated User Can Disable Internal Services (CVSS 6.9) - [CVE-2025-0130](https://cve.now/CVE-2025-0130.md): PAN-OS: Firewall Denial-of-Service (DoS) in the Web-Proxy Feature via a Burst of Maliciously Crafted Packets (CVSS 8.2) - [CVE-2025-0129](https://cve.now/CVE-2025-0129.md): Prisma Access Browser: Inappropriate control behavior in Prisma Access Browser (CVSS 9.3) - [CVE-2025-0123](https://cve.now/CVE-2025-0123.md): PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures (CVSS 5.9) - [CVE-2025-0119](https://cve.now/CVE-2025-0119.md): Cortex XDR Broker VM: Authenticated Command Injection Vulnerability in Broker VM (CVSS 6.3) - [CVE-2025-0128](https://cve.now/CVE-2025-0128.md): PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet (CVSS 8.7) - [CVE-2025-0127](https://cve.now/CVE-2025-0127.md): PAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-Series (CVSS 7.1) - [CVE-2025-0126](https://cve.now/CVE-2025-0126.md): PAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login (CVSS 8.3) - [CVE-2025-0125](https://cve.now/CVE-2025-0125.md): PAN-OS: Improper Neutralization of Input in the Management Web Interface (CVSS 6.9) - [CVE-2025-0124](https://cve.now/CVE-2025-0124.md): PAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface (CVSS 5.1) - [CVE-2025-0122](https://cve.now/CVE-2025-0122.md): Prisma SD-WAN: Denial of Service (DoS) Vulnerability Through Burst of Crafted Packets (CVSS 5.1) - [CVE-2025-0121](https://cve.now/CVE-2025-0121.md): Cortex XDR Agent: Local Windows User Can Crash the Agent (CVSS 6.8) - [CVE-2025-0120](https://cve.now/CVE-2025-0120.md): GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (CVSS 7.1) - [CVE-2025-0118](https://cve.now/CVE-2025-0118.md): GlobalProtect App: Execution of Unsafe ActiveX Control Vulnerability (CVSS 6.0) - [CVE-2025-0117](https://cve.now/CVE-2025-0117.md): GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (CVSS 7.1) - [CVE-2025-0116](https://cve.now/CVE-2025-0116.md): PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted LLDP Frame (CVSS 6.8) - [CVE-2025-0115](https://cve.now/CVE-2025-0115.md): PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI (CVSS 6.8) - [CVE-2025-0114](https://cve.now/CVE-2025-0114.md): PAN-OS: Denial of Service (DoS) in GlobalProtect (CVSS 8.2) - [CVE-2025-0112](https://cve.now/CVE-2025-0112.md): Cortex XDR Agent: Local Windows User Can Disable the Agent (CVSS 6.8) - [CVE-2025-0113](https://cve.now/CVE-2025-0113.md): Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containers (CVSS 5.3) - [CVE-2025-0110](https://cve.now/CVE-2025-0110.md): PAN-OS OpenConfig Plugin: Command Injection Vulnerability in OpenConfig Plugin (CVSS 8.6) - [CVE-2025-0111](https://cve.now/CVE-2025-0111.md): PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface (CVSS 7.1, KEV) - [CVE-2025-0109](https://cve.now/CVE-2025-0109.md): PAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web Interface (CVSS 6.9) - [CVE-2025-0108](https://cve.now/CVE-2025-0108.md): PAN-OS: Authentication Bypass in the Management Web Interface (CVSS 8.8, KEV) - [CVE-2025-0107](https://cve.now/CVE-2025-0107.md): Expedition: OS Command Injection Vulnerability (CVSS 7.7) - [CVE-2025-0106](https://cve.now/CVE-2025-0106.md): Expedition: Wildcard Expansion Vulnerability (CVSS 6.9) - [CVE-2025-0105](https://cve.now/CVE-2025-0105.md): Expedition: Arbitrary File Deletion Vulnerability (CVSS 6.9) - [CVE-2025-0104](https://cve.now/CVE-2025-0104.md): Expedition: Cross-Site Scripting (XSS) Vulnerability (CVSS 7.0) - [CVE-2025-0103](https://cve.now/CVE-2025-0103.md): Expedition: SQL Injection Vulnerability (CVSS 9.2) - [CVE-2024-3393](https://cve.now/CVE-2024-3393.md): PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet (CVSS 8.7, KEV) - [CVE-2024-5921](https://cve.now/CVE-2024-5921.md): GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation (CVSS 6.0) - [CVE-2024-9474](https://cve.now/CVE-2024-9474.md): PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface (CVSS 6.9, KEV) - [CVE-2024-0012](https://cve.now/CVE-2024-0012.md): PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) (CVSS 9.3, KEV) - [CVE-2024-2550](https://cve.now/CVE-2024-2550.md): PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet (CVSS 8.7) - [CVE-2024-5920](https://cve.now/CVE-2024-5920.md): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator (CVSS 4.6) - [CVE-2024-5917](https://cve.now/CVE-2024-5917.md): PAN-OS: Server-Side Request Forgery in WildFire (CVSS 2.1) - [CVE-2024-2552](https://cve.now/CVE-2024-2552.md): PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI) (CVSS 6.8) - [CVE-2024-5918](https://cve.now/CVE-2024-5918.md): PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User (CVSS 5.3) - [CVE-2024-5919](https://cve.now/CVE-2024-5919.md): PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability (CVSS 5.1) - [CVE-2024-2551](https://cve.now/CVE-2024-2551.md): PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet (CVSS 8.7) - [CVE-2024-9472](https://cve.now/CVE-2024-9472.md): PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic (CVSS 8.7) - [CVE-2024-9473](https://cve.now/CVE-2024-9473.md): GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (CVSS 5.2) - [CVE-2024-9471](https://cve.now/CVE-2024-9471.md): PAN-OS: Privilege Escalation (PE) Vulnerability in XML API (CVSS 5.1) - [CVE-2024-9470](https://cve.now/CVE-2024-9470.md): Cortex XSOAR: Information Disclosure Vulnerability (CVSS 5.3) - [CVE-2024-9469](https://cve.now/CVE-2024-9469.md): Cortex XDR Agent: Local Windows User Can Disable the Agent (CVSS 5.7) - [CVE-2024-9468](https://cve.now/CVE-2024-9468.md): PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet (CVSS 8.2) - [CVE-2024-9467](https://cve.now/CVE-2024-9467.md): Expedition: Reflected Cross-Site Scripting Vulnerability Leads to Expedition Session Disclosure (CVSS 7.0) - [CVE-2024-9466](https://cve.now/CVE-2024-9466.md): Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure (CVSS 8.2) - [CVE-2024-9465](https://cve.now/CVE-2024-9465.md): Expedition: SQL Injection Leads to Firewall Admin Credential Disclosure (CVSS 9.2, KEV) - [CVE-2024-9464](https://cve.now/CVE-2024-9464.md): Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure (CVSS 9.3) - [CVE-2024-9463](https://cve.now/CVE-2024-9463.md): Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure (CVSS 9.9, KEV) - [CVE-2024-8691](https://cve.now/CVE-2024-8691.md): PAN-OS: User Impersonation in GlobalProtect Portal (CVSS 5.3) - [CVE-2024-8690](https://cve.now/CVE-2024-8690.md): Cortex XDR Agent: Local Windows Administrator Can Disable the Agent (CVSS 5.6) - [CVE-2024-8689](https://cve.now/CVE-2024-8689.md): ActiveMQ Content Pack: Cleartext Exposure of Credentials (CVSS 6.0) - [CVE-2024-8688](https://cve.now/CVE-2024-8688.md): PAN-OS: Arbitrary File Read Vulnerability in the Command Line Interface (CLI) (CVSS 6.7) - [CVE-2024-8687](https://cve.now/CVE-2024-8687.md): PAN-OS: Cleartext Exposure of GlobalProtect Portal Passcodes (CVSS 6.9) - [CVE-2024-8686](https://cve.now/CVE-2024-8686.md): PAN-OS: Command Injection Vulnerability (CVSS 8.6) - [CVE-2024-5916](https://cve.now/CVE-2024-5916.md): PAN-OS: Cleartext Exposure of External System Secrets (CVSS 6.0) - [CVE-2024-5915](https://cve.now/CVE-2024-5915.md): GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (CVSS 5.2) - [CVE-2024-5914](https://cve.now/CVE-2024-5914.md): Cortex XSOAR: Command Injection in CommonScripts Pack (CVSS 7.0) - [CVE-2024-5913](https://cve.now/CVE-2024-5913.md): PAN-OS: Improper Input Validation Vulnerability in PAN-OS (CVSS 6.1) - [CVE-2024-5912](https://cve.now/CVE-2024-5912.md): Cortex XDR Agent: Improper File Signature Verification Checks (CVSS 6.8) - [CVE-2024-5911](https://cve.now/CVE-2024-5911.md): PAN-OS: File Upload Vulnerability in the Panorama Web Interface (CVSS 7.0) - [CVE-2024-5910](https://cve.now/CVE-2024-5910.md): Expedition: Missing Authentication Leads to Admin Account Takeover (CVSS 9.3, KEV) - [CVE-2024-5909](https://cve.now/CVE-2024-5909.md): Cortex XDR Agent: Local Windows User Can Disable the Agent (CVSS 6.8) - [CVE-2024-5908](https://cve.now/CVE-2024-5908.md): GlobalProtect App: Encrypted Credential Exposure via Log Files (CVSS 5.5) - [CVE-2024-5907](https://cve.now/CVE-2024-5907.md): Cortex XDR Agent: Local Privilege Escalation (PE) Vulnerability (CVSS 5.2) - [CVE-2024-5906](https://cve.now/CVE-2024-5906.md): Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (CVSS 4.8) - [CVE-2024-5905](https://cve.now/CVE-2024-5905.md): Cortex XDR Agent: Local Windows User Can Disrupt Functionality of the Agent (CVSS 2.0) - [CVE-2024-3400](https://cve.now/CVE-2024-3400.md): PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect (CVSS 10.0, KEV) - [CVE-2024-3388](https://cve.now/CVE-2024-3388.md): PAN-OS: User Impersonation in GlobalProtect SSL VPN (CVSS 4.1) - [CVE-2024-3387](https://cve.now/CVE-2024-3387.md): PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure (CVSS 5.3) - [CVE-2024-3386](https://cve.now/CVE-2024-3386.md): PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended (CVSS 5.3) - [CVE-2024-3385](https://cve.now/CVE-2024-3385.md): PAN-OS: Firewall Denial of Service (DoS) when GTP Security is Disabled (CVSS 7.5) - [CVE-2024-3384](https://cve.now/CVE-2024-3384.md): PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets (CVSS 7.5) - [CVE-2024-3383](https://cve.now/CVE-2024-3383.md): PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE) (CVSS 7.4) - [CVE-2024-3382](https://cve.now/CVE-2024-3382.md): PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted Packets (CVSS 7.5) - [CVE-2024-2433](https://cve.now/CVE-2024-2433.md): PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss (CVSS 4.3) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/vendors/palo-alto-networks Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.