ZeusQA
Start free

Known exploited vulnerabilities

Palo Alto Networks vulnerabilities attackers have used

Every Palo Alto Networks vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 16 Palo Alto Networks vulnerabilities as exploited in the wild, 3 of them added in the last 12 months and 6 used in ransomware campaigns. The most recent is CVE-2026-0322, added Oct 14, 2026. PAN-OS has the most entries (13).

In KEV, all time
16
Added, last 12 months
3
Used in ransomware
6
New CVEs this week
0

By product

PAN-OS (13), Expedition (3).

Every Palo Alto Networks entry in CISA KEV

  1. CVE-2026-0322

    Added · due

    Palo Alto Networks PAN-OS Code Injection Vulnerability

    Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.

  2. CVE-2026-0257

    RansomwareAdded · due

    Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

    Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.

  3. CVE-2026-0300

    Added · due

    Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

    Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the…

  4. CVE-2025-0111

    Added · due

    Palo Alto Networks PAN-OS File Read Vulnerability

    Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem…

  5. CVE-2025-0108

    Added · due

    Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

    Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the…

  6. CVE-2024-3393

    Added · due

    Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

    Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to…

  7. CVE-2024-9474

    RansomwareAdded · due

    Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

    Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.

  8. CVE-2024-0012

    RansomwareAdded · due

    Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

    Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.

  9. CVE-2024-9465

    Added · due

    Palo Alto Networks Expedition SQL Injection Vulnerability

    Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this…

  10. CVE-2024-9463

    Added · due

    Palo Alto Networks Expedition OS Command Injection Vulnerability

    Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device…

  11. CVE-2024-5910

    Added · due

    Palo Alto Networks Expedition Missing Authentication Vulnerability

    Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets, credentials, and other data.

  12. CVE-2024-3400

    RansomwareAdded · due

    Palo Alto Networks PAN-OS Command Injection Vulnerability

    Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.

  13. CVE-2022-0028

    Added · due

    Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability

    A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.

  14. CVE-2017-15944

    Added · due

    Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

    Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.

  15. CVE-2020-2021

    RansomwareAdded · due

    Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

    Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.

  16. CVE-2019-1579

    RansomwareAdded · due

    Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

    Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works