Loading story…
Palo Alto Networks disclosed CVE-2026-0310, a high-severity XML-processing buffer overflow in PAN-OS that can allow an unauthenticated remote attacker to execute arbitrary code as root on affected PA-Series hardware firewalls. The flaw, scored 9.2 CVSS-B, is reachable through vulnerable management-web or dataplane interfaces using specially crafted XML; exploitation is considered high complexity. On VM-Series appliances, the impact is limited to denial of service, while Prisma Access and Cloud NGFW deployments face more restricted exposure because exploitation requires authentication and their external interfaces are less accessible.
Palo Alto Networks released fixed PAN-OS versions and states that no workaround is available; administrators should immediately apply the vendor updates and restrict management access to trusted networks. Canadian and Italian government advisories also identify affected PAN-OS, Prisma Access, and Cloud NGFW on AWS and Azure products, and flag PAN-SA-2026-0012 for Chromium vulnerabilities affecting Prisma Browser versions before 151.26.5.170. Palo Alto reported no known exploitation of CVE-2026-0310 in the wild as of September 9, 2026.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-905 concerning vulnerabilities affecting Palo Alto Networks products, including CVE-2026-0310 and PAN-SA-2026-0012 for Chromium's September 2026 update. The advisory listed Cloud NGFW on AWS and Azure, PAN-OS, Prisma Access, and Prisma Browser as affected and urged administrators to apply available updates.
As of September 9, 2026, Palo Alto Networks stated it was not aware of malicious exploitation in the wild of CVE-2026-0310.
Palo Alto Networks disclosed CVE-2026-0310, a high-severity XML-processing buffer overflow that can permit unauthenticated remote root-level code execution on affected PA-Series firewalls; exploitation on VM-Series is limited to denial of service. The company released fixed PAN-OS versions and stated that no workaround is available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
7 references tracked. Mallory keeps watching after this page renders.
socprime.com
Open sourcemalware.news
Open sourceacn.gov.it
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcecirt.gy
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks disclosed and patched multiple vulnerabilities in **PAN-OS** affecting **PA-Series**, **VM-Series**, and **Panorama**, including `CVE-2026-0273`, an authenticated administrator command injection flaw in the **CLI** and **web management interface** that can allow arbitrary commands to run as **root**. The vendor also fixed `CVE-2026-0272`, an authenticated **CLI privilege escalation** issue, and `CVE-2026-0266`, a **stored XSS** vulnerability in the web interface. A separate issue, `CVE-2026-0269`, can trigger a **denial of service** through crafted tunnel traffic and repeatedly reboot affected firewalls, potentially forcing them into maintenance mode. Affected versions span supported **PAN-OS 12.1, 11.2, 11.1, and 10.2** release trains, while **Cloud NGFW** and **Prisma Access** were reported as unaffected. Palo Alto Networks said it was not aware of active exploitation at disclosure time and urged customers to upgrade promptly, restrict management access to trusted internal IPs, limit CLI exposure, and use hardened jump boxes; for `CVE-2026-0273`, organizations with **Threat Prevention** can also enable dedicated **Threat IDs** to help block exploit attempts when management traffic is inspectable and decrypted.
Jun 29, 2026
Palo Alto Networks disclosed and patched **13 vulnerabilities** across its products, led by **`CVE-2026-0288`**, a high-severity flaw in **PAN-OS** that can let an unauthenticated attacker with network access trigger memory corruption through specially crafted traffic. The bug stems from multiple buffer overflows in the **User-ID Terminal Server Agent (TSA)** component and can lead to **denial of service** and potentially **arbitrary code execution** on affected firewalls. Palo Alto said the issue affects PAN-OS devices only when at least one TSA entry is configured, while **Panorama** and **Cloud NGFW on AWS** are not affected. The company assigned the flaw a **CVSS-B score of 9.2** for exposed deployments and said it has **no evidence of active exploitation**, but urged customers to patch immediately or restrict TSA access to trusted internal IP addresses as a mitigation. The broader advisory batch also addressed medium- and low-severity issues in **PAN-OS** and **Prisma Access Agent**, including vulnerabilities that could enable **root command execution, unauthorized internal requests, authentication bypass, VPN interception via MitM, DLP policy bypass, privilege escalation, XSS-driven code execution, file deletion, and information disclosure**.
Jul 10, 2026
Palo Alto Networks disclosed and patched **CVE-2026-0300**, a critical `PAN-OS` vulnerability in the **User-ID Authentication Portal** that can let an unauthenticated remote attacker execute arbitrary code with **root** privileges. The flaw, rated **CVSS 9.3**, is described as a stack overflow and out-of-bounds write issue affecting multiple `PAN-OS` release lines, including versions in the `10.2`, `11.1`, `11.2`, and `12.1` branches, on affected **PA Series** and **VM-Series** firewalls. Palo Alto Networks reported signs of **active exploitation**, particularly on devices exposed to the internet or reachable from untrusted IP addresses, and **CISA** added the bug to its **Known Exploited Vulnerabilities** catalog. Exploitation depends on the Authentication Portal being enabled and a management interface profile with a response page being attached to a Layer 3 interface reachable by untrusted traffic; defenders were urged to upgrade to fixed releases, restrict portal access to trusted zones or IP addresses, disable the feature if unnecessary, and investigate systems for signs of compromise.
Jul 24, 2026