Loading story…
Palo Alto Networks disclosed and patched multiple vulnerabilities in PAN-OS affecting PA-Series, VM-Series, and Panorama, including CVE-2026-0273, an authenticated administrator command injection flaw in the CLI and web management interface that can allow arbitrary commands to run as root. The vendor also fixed CVE-2026-0272, an authenticated CLI privilege escalation issue, and CVE-2026-0266, a stored XSS vulnerability in the web interface. A separate issue, CVE-2026-0269, can trigger a denial of service through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode.
Affected versions span supported PAN-OS 12.1, 11.2, 11.1, and 10.2 release trains, while Cloud NGFW and Prisma Access were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for CVE-2026-0273, organizations with Threat Prevention can also enable dedicated Threat IDs to help block exploit attempts when management traffic is inspectable and decrypted.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
In its disclosure coverage, Palo Alto Networks said it was not aware of malicious exploitation of the PAN-OS vulnerabilities at the time of disclosure. The company recommended prompt upgrades and mitigation steps including restricting management and CLI access.
On June 10, 2026, Palo Alto Networks published advisories for CVE-2026-0273, CVE-2026-0272, CVE-2026-0266, and CVE-2026-0269 affecting PAN-OS. The issues include authenticated command injection, CLI privilege escalation, stored XSS, and a tunnel-traffic denial-of-service flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurity.paloaltonetworks.com
Open sourcesecurity.paloaltonetworks.com
Open sourcesecurity.paloaltonetworks.com
Open sourcesecurity.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed **CVE-2026-0310**, a high-severity XML-processing buffer overflow in PAN-OS that can allow an unauthenticated remote attacker to execute arbitrary code as `root` on affected PA-Series hardware firewalls. The flaw, scored 9.2 CVSS-B, is reachable through vulnerable management-web or dataplane interfaces using specially crafted XML; exploitation is considered high complexity. On VM-Series appliances, the impact is limited to denial of service, while Prisma Access and Cloud NGFW deployments face more restricted exposure because exploitation requires authentication and their external interfaces are less accessible. Palo Alto Networks released fixed PAN-OS versions and states that no workaround is available; administrators should immediately apply the vendor updates and restrict management access to trusted networks. Canadian and Italian government advisories also identify affected PAN-OS, Prisma Access, and Cloud NGFW on AWS and Azure products, and flag **PAN-SA-2026-0012** for Chromium vulnerabilities affecting Prisma Browser versions before `151.26.5.170`. Palo Alto reported no known exploitation of CVE-2026-0310 in the wild as of September 9, 2026.
Sep 10, 2026
Palo Alto Networks disclosed and patched **13 vulnerabilities** across its products, led by **`CVE-2026-0288`**, a high-severity flaw in **PAN-OS** that can let an unauthenticated attacker with network access trigger memory corruption through specially crafted traffic. The bug stems from multiple buffer overflows in the **User-ID Terminal Server Agent (TSA)** component and can lead to **denial of service** and potentially **arbitrary code execution** on affected firewalls. Palo Alto said the issue affects PAN-OS devices only when at least one TSA entry is configured, while **Panorama** and **Cloud NGFW on AWS** are not affected. The company assigned the flaw a **CVSS-B score of 9.2** for exposed deployments and said it has **no evidence of active exploitation**, but urged customers to patch immediately or restrict TSA access to trusted internal IP addresses as a mitigation. The broader advisory batch also addressed medium- and low-severity issues in **PAN-OS** and **Prisma Access Agent**, including vulnerabilities that could enable **root command execution, unauthorized internal requests, authentication bypass, VPN interception via MitM, DLP policy bypass, privilege escalation, XSS-driven code execution, file deletion, and information disclosure**.
Jul 10, 2026
Palo Alto Networks disclosed and patched **CVE-2026-0300**, a critical `PAN-OS` vulnerability in the **User-ID Authentication Portal** that can let an unauthenticated remote attacker execute arbitrary code with **root** privileges. The flaw, rated **CVSS 9.3**, is described as a stack overflow and out-of-bounds write issue affecting multiple `PAN-OS` release lines, including versions in the `10.2`, `11.1`, `11.2`, and `12.1` branches, on affected **PA Series** and **VM-Series** firewalls. Palo Alto Networks reported signs of **active exploitation**, particularly on devices exposed to the internet or reachable from untrusted IP addresses, and **CISA** added the bug to its **Known Exploited Vulnerabilities** catalog. Exploitation depends on the Authentication Portal being enabled and a management interface profile with a response page being attached to a Layer 3 interface reachable by untrusted traffic; defenders were urged to upgrade to fixed releases, restrict portal access to trusted zones or IP addresses, disable the feature if unnecessary, and investigate systems for signs of compromise.
Jul 24, 2026