Skip to content
OpenAdvisories
High WID-SEC-2026-2261 10 CVEs

Palo Alto Networks PAN-OS: Mehrere Schwachstellen

Published Jul 8, 2026 · Updated Jul 9, 2026 · Revision 2 · de-DE

Vendor: Palo Alto Networks Product: PAN-OS

Summary

Ein Angreifer kann mehrere Schwachstellen in Palo Alto Networks PAN-OS ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.

Product

PAN-OS ist das Betriebssystem der Sicherheitssysteme / Firewalls der Firma Palo Alto Networks.

Vulnerabilities 10

  • Medium 6.0
    CVE-2026-0286

    PAN-OS: Authenticated Command Injection in CLI

    A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access …

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 4.8
    CVE-2026-0288

    PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent

    Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbit…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 4.7
    CVE-2026-0284

    PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN)

    An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corrup…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 4.6
    CVE-2026-0287

    PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing

    Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interfa…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 4.5
    CVE-2026-0283

    PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN)

    An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection. Panorama, …

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Medium 4.4
    CVE-2026-0285

    PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface

    A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services. The secur…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Low 1.7
    CVE-2026-0280

    PAN-OS: IPv6 Firewall Policy Bypass

    An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services. Cl…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Low 1.7
    CVE-2026-0281

    PAN-OS: Information Disclosure Vulnerability in Management Web Interface

    An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious …

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Low 1.2
    CVE-2026-0282

    PAN-OS: File Deletion Vulnerability in Management Web Interface

    A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory. The security risk posed by this issue is minimized by rest…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices
  • Low 0.4
    CVE-2026-0279

    PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities

    Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to stor…

    Palo Alto Networks PAN-OS Prisma Access Cloud NGFW Network devices

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-42678, EUVD-2026-42679, EUVD-2026-42680, EUVD-2026-42681, EUVD-2026-42682, EUVD-2026-42672, EUVD-2026-42675, EUVD-2026-42676, EUVD-2026-42677

  2. #1

    Initiale Fassung

References