Loading story…
Palo Alto Networks published fixes for multiple PAN-OS vulnerabilities affecting supported releases (including PAN-OS 12.1, 11.2, 11.1, and 10.2) and related services such as Prisma Access and Prisma Browser. The Canadian Centre for Cyber Security amplified the vendor guidance, pointing organizations to apply updates and mitigations for PAN-OS and Prisma products, including CVE-2026-0228 and CVE-2026-0229, and a separate Chromium monthly update advisory referenced by Palo Alto.
CVE-2026-0229 is a network-reachable denial-of-service condition in PAN-OS’s Advanced DNS Security (ADNS) feature that can allow an unauthenticated attacker to trigger system reboots with a maliciously crafted packet; repeated triggering can push a firewall into maintenance mode, creating a high availability impact. Exposure requires ADNS to be enabled and a spyware profile action set to block, sinkhole, or alert (i.e., not allow); Palo Alto stated Cloud NGFW and Prisma Access are not impacted by this specific issue and reported no known exploitation. CVE-2026-0228 involves improper certificate validation that can allow Windows Terminal Server Agents to connect using expired certificates under certain configurations, with no workaround noted by the vendor; affected organizations are advised to upgrade to fixed PAN-OS versions per Palo Alto’s guidance.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Later on 2026-02-11, the Canadian Centre for Cyber Security published advisory AV26-118 highlighting Palo Alto Networks' newly released security advisories. It urged administrators to review the advisories, apply mitigations, and install the necessary updates.
Palo Alto Networks disclosed CVE-2026-0229 on 2026-02-11 as a denial-of-service vulnerability in the Advanced DNS Security feature of PAN-OS. The advisory specified affected versions and the releases containing fixes.
Palo Alto Networks disclosed CVE-2026-0228 on 2026-02-11 as an improper validation of a Terminal Server Agent certificate in PAN-OS. The advisory identified affected versions and directed customers to upgrade to fixed releases.
On 2026-02-11, Palo Alto Networks published security advisories covering multiple vulnerabilities affecting PAN-OS, Prisma Access on PAN-OS, and Prisma Browser. The advisories included CVE-2026-0228, CVE-2026-0229, and a February 2026 Chromium security update, with affected versions and fixed releases identified.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcesecurity.paloaltonetworks.com
Open sourcesecurity.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed a denial-of-service (DoS) vulnerability, identified as CVE-2025-4619, affecting PAN-OS software on PA-Series, VM-Series, CN-Series firewalls, and Prisma Access. This vulnerability allows an unauthenticated attacker to reboot a firewall by sending specially crafted packets through the data plane, potentially causing the device to enter maintenance mode if exploited repeatedly. The company has detailed affected and unaffected PAN-OS versions and confirmed that Cloud NGFW is not impacted. Prisma Access customers have largely been upgraded, with remaining updates scheduled. Additionally, Palo Alto Networks released its November 2025 monthly vulnerability update for Chromium and Prisma Browser, addressing multiple CVEs, including several Chromium vulnerabilities and three specific to Prisma Browser (CVE-2025-4616, CVE-2025-4617, CVE-2025-4618). The Canadian Centre for Cyber Security issued an advisory summarizing these disclosures and urging administrators to review the advisories, apply mitigations, and update affected products to secure their environments against these vulnerabilities.
Jul 12, 2026
Palo Alto Networks disclosed and patched multiple vulnerabilities in **PAN-OS** affecting **PA-Series**, **VM-Series**, and **Panorama**, including `CVE-2026-0273`, an authenticated administrator command injection flaw in the **CLI** and **web management interface** that can allow arbitrary commands to run as **root**. The vendor also fixed `CVE-2026-0272`, an authenticated **CLI privilege escalation** issue, and `CVE-2026-0266`, a **stored XSS** vulnerability in the web interface. A separate issue, `CVE-2026-0269`, can trigger a **denial of service** through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode. Affected versions span supported **PAN-OS 12.1, 11.2, 11.1, and 10.2** release trains, while **Cloud NGFW** and **Prisma Access** were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for `CVE-2026-0273`, organizations with **Threat Prevention** can also enable dedicated **Threat IDs** to help block exploit attempts when management traffic is inspectable and decrypted.
Jun 29, 2026
Palo Alto Networks released fixes for **CVE-2024-3393**, a high-severity denial-of-service flaw in the **PAN-OS DNS Security** component that can be exploited remotely and without authentication using specially crafted DNS packets. Successful exploitation can force affected firewalls to reboot and, if repeated, push them into maintenance mode, leaving devices unavailable; CSIRT.SK reported the vulnerability is being **actively exploited in the wild**. Affected products include multiple **PAN-OS 10.1, 10.2, 11.1, and 11.2** releases, as well as **Prisma Access** deployments running vulnerable PAN-OS versions. Exploitation requires **DNS Security Logging** to be enabled along with either a **DNS Security License** or **Advanced DNS Security License**. Palo Alto urged organizations to upgrade immediately to fixed releases and to apply configuration-based mitigations where patching cannot be completed right away.
Jul 24, 2026