By year
10
12
15
17
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Palo Alto Networks flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2026-0322 Palo Alto Networks PAN-OS Code InjectionExploited since Oct 14, 2026 · CVSS 8.6
- CVE-2026-0257 Palo Alto Networks PAN-OS Authentication BypassExploited since May 29, 2026 · ransomware · CVSS 7.8
- CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds WriteExploited since May 6, 2026 · CVSS 9.3
- CVE-2025-0111 Palo Alto Networks PAN-OS File ReadExploited since Feb 20, 2025 · CVSS 7.1
- CVE-2025-0108 Palo Alto Networks PAN-OS Authentication BypassExploited since Feb 18, 2025 · CVSS 8.8
- CVE-2024-3393 Palo Alto Networks PAN-OS Malicious DNS PacketExploited since Dec 30, 2024 · CVSS 8.7
- CVE-2024-9474 Palo Alto Networks PAN-OS Management Interface OS Command InjectionExploited since Nov 18, 2024 · ransomware · CVSS 6.9
- CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication BypassExploited since Nov 18, 2024 · ransomware · CVSS 9.3
- CVE-2024-9465 Palo Alto Networks Expedition SQL InjectionExploited since Nov 14, 2024 · CVSS 9.2
- CVE-2024-9463 Palo Alto Networks Expedition OS Command InjectionExploited since Nov 14, 2024 · CVSS 9.9
- CVE-2024-5910 Palo Alto Networks Expedition Missing AuthenticationExploited since Nov 7, 2024 · CVSS 9.3
- CVE-2024-3400 Palo Alto Networks PAN-OS Command InjectionExploited since Apr 12, 2024 · ransomware · CVSS 10
- CVE-2022-0028 Palo Alto Networks PAN-OS Reflected Amplification Denial-of-ServiceExploited since Aug 22, 2022 · CVSS 8.6
- CVE-2017-15944 Palo Alto Networks PAN-OS Remote Code ExecutionExploited since Aug 18, 2022 · CVSS 9.8
- CVE-2020-2021 Palo Alto Networks PAN-OS Authentication BypassExploited since Mar 25, 2022 · ransomware · CVSS 10
- CVE-2019-1579 Palo Alto Networks PAN-OS Remote Code ExecutionExploited since Jan 10, 2022 · ransomware · CVSS 8.1
Latest high and critical flaws
- CVE-2026-45165 An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch.High 8.6 · Oct 15, 2026
- CVE-2026-0322 Palo Alto Networks PAN-OS Code InjectionExploited · High 8.6 · Oct 14, 2026
- CVE-2026-0310 A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network acceHigh 7.2 · Sep 10, 2026
- CVE-2026-0288 Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attHigh 7.2 · Jul 8, 2026
- CVE-2026-0274 An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker High 8.1 · Jun 10, 2026
- CVE-2026-0257 Palo Alto Networks PAN-OS Authentication BypassExploited · High 7.8 · May 13, 2026
- CVE-2026-0236 A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally High 7.3 · May 13, 2026
- CVE-2026-0265 An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication cHigh 7.2 · May 13, 2026
- CVE-2026-0264 A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network High 7.2 · May 13, 2026
- CVE-2026-0263 A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitHigh 7.2 · May 13, 2026
- CVE-2026-0237 An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automatioHigh 7.3 · May 13, 2026
- CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds WriteExploited · Critical 9.3 · May 6, 2026
- CVE-2026-0234 An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that eHigh 7.2 · Apr 13, 2026
- CVE-2025-4235 An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the service account password under specific High 7.2 · Sep 12, 2025
- CVE-2025-0141 An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to escalHigh 8.4 · Jul 9, 2025
- CVE-2025-4232 An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrativHigh 8.5 · Jun 12, 2025
- CVE-2025-4231 A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user.High 8.6 · Jun 12, 2025
- CVE-2025-4230 A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary High 8.4 · Jun 12, 2025
- CVE-2025-0130 A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciHigh 8.2 · May 14, 2025
- CVE-2025-0129 An improper exception check in Palo Alto Networks Prisma Access Browser allows a low privileged user to prevent Prisma Access Browser from applying it's Policy Critical 9.3 · Apr 11, 2025
- CVE-2025-0128 A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enablHigh 8.7 · Apr 10, 2025
- CVE-2025-0127 A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary High 7.1 · Apr 10, 2025
- CVE-2025-0126 When configured using SAML, a session fixation vulnerability in the GlobalProtect™ login enables an attacker to impersonate a legitimate authorized user and perHigh 8.3 · Apr 10, 2025
- CVE-2025-0120 A vulnerability with a privilege management mechanism in the Palo Alto Networks GlobalProtect™ app on Windows devices allows a locally authenticated non-adminisHigh 7.1 · Apr 10, 2025
- CVE-2025-0117 A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrativeHigh 7.1 · Mar 12, 2025
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.