Vulnerabilities by vendor · updated on every deploy
Palo Alto Networks vulnerabilities: exploited CVEs and our analysis
Palo Alto Networks has 16 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 3 of them added in the last 12 months and 6 known to be used in ransomware campaigns. Below: the 3 analyses Zero Hunt Research published on Palo Alto Networks products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
16
CVEs in CISA KEV
3
Added in the last 12 months
6
Known ransomware use
3
Zero Hunt analyses
Products with the most KEV entries: PAN-OS (13) · Expedition (3)
Our analysis of Palo Alto Networks vulnerabilities
2026-10-15
PAN-OS CVE-2026-0322: root RCE on the management interface, actively exploitedCVE-2026-0322 lets an authenticated admin run code as root on the PAN-OS management interface. It is CISA KEV, exploited in the wild, and the federal fix is due October 17.
2026-07-22
Qilin ransomware and CVE-2026-0257: the VPN bug is only the front doorQilin affiliates chain the PAN-OS GlobalProtect bug CVE-2026-0257 into domain-wide encryption. The perimeter breach is silent; the kill chain that follows is loud on the wire.
2026-06-02
PAN-OS CVE-2026-0257: when GlobalProtect is patched and exploitable at the same timePalo Alto patched the GlobalProtect cookie-forge auth bypass on May 13. The exploit still works on patched firewalls if the portal reuses its TLS certificate. Patch state is not configuration state.
All 16 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-10-14 | CVE-2026-0322 | PAN-OS Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. | 2026-10-17 | Forensic triage | Read → |
| 2026-05-29 | CVE-2026-0257 | PAN-OS Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. | 2026-06-01 | Ransomware | Read → |
| 2026-05-06 | CVE-2026-0300 | PAN-OS Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root… | 2026-05-09 | — | |
| 2025-02-20 | CVE-2025-0111 | PAN-OS Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on… | 2025-03-13 | — | |
| 2025-02-18 | CVE-2025-0108 | PAN-OS Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to b… | 2025-03-11 | — | |
| 2024-12-30 | CVE-2024-3393 | PAN-OS Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Rep… | 2025-01-20 | — | |
| 2024-11-18 | CVE-2024-9474 | PAN-OS Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrat… | 2024-12-09 | Ransomware | — |
| 2024-11-18 | CVE-2024-0012 | PAN-OS Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. | 2024-12-09 | Ransomware | — |
| 2024-11-14 | CVE-2024-9465 | Expedition Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and devic… | 2024-12-05 | — | |
| 2024-11-14 | CVE-2024-9463 | Expedition Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext… | 2024-12-05 | — | |
| 2024-11-07 | CVE-2024-5910 | Expedition Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentia… | 2024-11-28 | — | |
| 2024-04-12 | CVE-2024-3400 | PAN-OS Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall. | 2024-04-19 | Ransomware | — |
| 2022-08-22 | CVE-2022-0028 | PAN-OS A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. | 2022-09-12 | — | |
| 2022-08-18 | CVE-2017-15944 | PAN-OS Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained. | 2022-09-08 | — | |
| 2022-03-25 | CVE-2020-2021 | PAN-OS Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication. | 2022-04-15 | Ransomware | — |
| 2022-01-10 | CVE-2019-1579 | PAN-OS Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. | 2022-07-10 | Ransomware | — |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Palo Alto Networks vulnerabilities are in the CISA KEV catalog?
16 in catalog version 2026.10.21, the first added on 2022-01-10 and the most recent on 2026-10-14. 3 were added in the last 12 months.
Which Palo Alto Networks products have the most exploited vulnerabilities?
By KEV entries: PAN-OS (13), Expedition (3).
Are Palo Alto Networks vulnerabilities used in ransomware attacks?
CISA marks 6 of the 16 Palo Alto Networks entries as known to be used in ransomware campaigns. The table flags them.
Is the next Palo Alto Networks CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Check Point · Langflow · Arista · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5