Palo Alto Networks vulnerabilities
PAN-OS and GlobalProtect vulnerabilities affecting Palo Alto Networks firewalls — perimeter devices where a single command-injection flaw can mean full network compromise.
We track 16 Palo Alto Networks CVEs, 16 of them on CISA's Known Exploited Vulnerabilities catalog (6 flagged for ransomware use). The latest KEV addition is CVE-2026-0322, added .
- CVEs tracked
- 16
- On CISA KEV
- 16
- Ransomware use
- 6
- Rated critical
- 9
Most-exploited Palo Alto Networks products
Latest Palo Alto Networks coverage
Our reporting filed under Palo Alto Networks, plus any story that cites one of its CVEs.
CISA Adds Plex2Shell, Siemens, SiteGuard to KEV
CISA added exploited flaws from Plex Media Server, Siemens Software Center, and SiteGuard to its KEV catalog. The Plex2Shell chain is under mass attack now.
Palo Alto PAN-OS Zero-Day Added to KEV, Fix by Oct 17
CVE-2026-0322, a PAN-OS code injection flaw, is confirmed exploited in attacks. CISA added it to KEV with an October 17 remediation deadline.
Germany Arrests Core Qilin Member After Japan Extradition
German authorities arrested a Russian national suspected of being a core Qilin ransomware member after extradition from Japan, confirmed by Japan's National Police Agency.
Qilin exploits PAN-OS GlobalProtect CVE-2026-0257
Arctic Wolf documents Qilin ransomware breaching networks through a two-month-old PAN-OS GlobalProtect authentication bypass, and assesses with moderate confidence that intrusions are ongoing.
ChocoPoC: Fake CVE PoC Repos Ship a Stealer
YesWeHack and Sekoia disclosed a stealer campaign hiding inside GitHub PoC repos and PyPI packages, targeting the researchers who clone them. Treat every fresh 'PoC for hot CVE' repo as hostile until you've read every dependency.
PAN-OS GlobalProtect Zero-Day Gave Attackers Root
CVE-2024-3400, a maximum-severity command-injection flaw in Palo Alto Networks' PAN-OS GlobalProtect feature, was exploited in the wild before a patch existed — handing attackers root access to the perimeter firewall.
Known exploited Palo Alto Networks vulnerabilities
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerabilitywrite-up | [ HIGH ] | — | 2.1% | ||
| CVE-2026-0257 PAN-OS GlobalProtect authentication bypassransomware usewrite-up | [ CRITICAL ] | 9.1 | 95.6% | ||
| CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability | [ CRITICAL ] | 9.8 | 41.7% | ||
| CVE-2025-0111 Palo Alto Networks PAN-OS File Read Vulnerability | [ MEDIUM ] | 6.5 | 2.0% | ||
| CVE-2025-0108 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | [ CRITICAL ] | 9.1 | 98.5% | ||
| CVE-2024-3393 Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability | [ HIGH ] | 7.5 | 30.2% | ||
| CVE-2024-9474 Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerabilityransomware use | [ HIGH ] | 7.2 | 93.8% | ||
| CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 99.8% | ||
| CVE-2024-9465 Palo Alto Networks Expedition SQL Injection Vulnerability | [ CRITICAL ] | 9.1 | 99.6% | ||
| CVE-2024-9463 Palo Alto Networks Expedition OS Command Injection Vulnerability | [ HIGH ] | 7.5 | 98.5% | ||
| CVE-2024-5910 Palo Alto Networks Expedition Missing Authentication Vulnerability | [ CRITICAL ] | 9.8 | 91.7% | ||
| CVE-2024-3400 Palo Alto Networks PAN-OS GlobalProtect Command Injection Zero-Dayransomware usewrite-up | [ CRITICAL ] | 10.0 | 100.0% | ||
| CVE-2022-0028 Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability | [ HIGH ] | 8.6 | 2.7% | ||
| CVE-2017-15944 Palo Alto Networks PAN-OS Remote Code Execution Vulnerability | [ CRITICAL ] | 9.8 | 98.3% | ||
| CVE-2020-2021 Palo Alto Networks PAN-OS Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 10.0 | 4.4% | ||
| CVE-2019-1579 Palo Alto Networks PAN-OS Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 8.1 | 44.2% |
Every Palo Alto Networks CVE on CISA's KEV catalog that we hold, newest KEV addition first. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else.
Machine-readable: /api/v1/vendors/palo-alto-networks.json.
Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.