Loading story…
Palo Alto Networks disclosed a denial-of-service (DoS) vulnerability, identified as CVE-2025-4619, affecting PAN-OS software on PA-Series, VM-Series, CN-Series firewalls, and Prisma Access. This vulnerability allows an unauthenticated attacker to reboot a firewall by sending specially crafted packets through the data plane, potentially causing the device to enter maintenance mode if exploited repeatedly. The company has detailed affected and unaffected PAN-OS versions and confirmed that Cloud NGFW is not impacted. Prisma Access customers have largely been upgraded, with remaining updates scheduled.
Additionally, Palo Alto Networks released its November 2025 monthly vulnerability update for Chromium and Prisma Browser, addressing multiple CVEs, including several Chromium vulnerabilities and three specific to Prisma Browser (CVE-2025-4616, CVE-2025-4617, CVE-2025-4618). The Canadian Centre for Cyber Security issued an advisory summarizing these disclosures and urging administrators to review the advisories, apply mitigations, and update affected products to secure their environments against these vulnerabilities.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published alert AV25-748 referencing a Palo Alto Networks security advisory. This reflects government-side dissemination of Palo Alto's November 12, 2025 security advisory information.
Palo Alto Networks released advisory PAN-SA-2025-0018 covering the November 2025 monthly vulnerability update for Chromium and Prisma Browser. The publication indicates security fixes or vulnerability information for those products were made available on November 12, 2025.
Palo Alto Networks published a security advisory for CVE-2025-4619 describing a PAN-OS firewall denial-of-service condition triggered by specially crafted packets. The advisory publicly documented the vulnerability on November 12, 2025.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
security.paloaltonetworks.com
Open sourcesecurity.paloaltonetworks.com
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks published fixes for multiple **PAN-OS** vulnerabilities affecting supported releases (including PAN-OS 12.1, 11.2, 11.1, and 10.2) and related services such as *Prisma Access* and *Prisma Browser*. The Canadian Centre for Cyber Security amplified the vendor guidance, pointing organizations to apply updates and mitigations for PAN-OS and Prisma products, including **CVE-2026-0228** and **CVE-2026-0229**, and a separate Chromium monthly update advisory referenced by Palo Alto. **CVE-2026-0229** is a network-reachable denial-of-service condition in PAN-OS’s **Advanced DNS Security (ADNS)** feature that can allow an unauthenticated attacker to trigger system reboots with a maliciously crafted packet; repeated triggering can push a firewall into maintenance mode, creating a high availability impact. Exposure requires ADNS to be enabled and a spyware profile action set to `block`, `sinkhole`, or `alert` (i.e., not `allow`); Palo Alto stated *Cloud NGFW* and *Prisma Access* are not impacted by this specific issue and reported no known exploitation. **CVE-2026-0228** involves improper certificate validation that can allow Windows Terminal Server Agents to connect using expired certificates under certain configurations, with no workaround noted by the vendor; affected organizations are advised to upgrade to fixed PAN-OS versions per Palo Alto’s guidance.
Jun 29, 2026
**Palo Alto Networks** published security advisories addressing multiple vulnerabilities affecting *Cortex XDR* components and *Prisma Browser*, including **CVE-2026-0230** (macOS Cortex XDR Agent can be disabled by a local administrator) and **CVE-2026-0231** (Cortex XDR Broker VM information disclosure). For CVE-2026-0230, Palo Alto Networks reported a protection-mechanism issue on macOS that could allow malware to operate without detection if a local admin disables the agent; affected versions include *Cortex XDR Agent* **8.7-CE** prior to `8.7.101-CE` and **8.3-CE** prior to `8.3.102-CE` on macOS, with Palo Alto Networks stating it is not aware of in-the-wild exploitation. For CVE-2026-0231, an authenticated user with network access to the Broker VM could obtain and modify sensitive information by triggering a live terminal session via the Cortex UI and changing configuration settings; the issue affects *Cortex XDR Broker VM* **30.0.0** prior to `30.0.49`, and Palo Alto Networks stated there are no workarounds and that upgrading is required. Palo Alto Networks also released **PAN-SA-2026-0003**, incorporating upstream **Chromium** security fixes into *Prisma Browser* and listing multiple Chromium CVEs (including **CVE-2026-2314**, **CVE-2026-2321**, and **CVE-2026-2441**); *Prisma Browser* versions prior to `145.7.9.76` are affected and should be updated. The **Canadian Centre for Cyber Security** echoed these Palo Alto Networks advisories and urged organizations to apply the necessary updates and mitigations. A separate Canadian advisory covered **Splunk** product vulnerabilities across *Splunk Enterprise*, *Splunk Cloud Platform*, and multiple *AppDynamics* agents, but it is unrelated to the Palo Alto Networks Cortex/Prisma issues.
Jun 29, 2026
Palo Alto Networks disclosed **CVE-2026-0310**, a high-severity XML-processing buffer overflow in PAN-OS that can allow an unauthenticated remote attacker to execute arbitrary code as `root` on affected PA-Series hardware firewalls. The flaw, scored 9.2 CVSS-B, is reachable through vulnerable management-web or dataplane interfaces using specially crafted XML; exploitation is considered high complexity. On VM-Series appliances, the impact is limited to denial of service, while Prisma Access and Cloud NGFW deployments face more restricted exposure because exploitation requires authentication and their external interfaces are less accessible. Palo Alto Networks released fixed PAN-OS versions and states that no workaround is available; administrators should immediately apply the vendor updates and restrict management access to trusted networks. Canadian and Italian government advisories also identify affected PAN-OS, Prisma Access, and Cloud NGFW on AWS and Azure products, and flag **PAN-SA-2026-0012** for Chromium vulnerabilities affecting Prisma Browser versions before `151.26.5.170`. Palo Alto reported no known exploitation of CVE-2026-0310 in the wild as of September 9, 2026.
Sep 10, 2026