{"schema_version":"1","data":[{"id":2938,"advisory_id":"749a92ca-8914-4256-87d7-3ffbdc37df3b","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-1579","source_published_at":"2022-01-10T00:00:00+00:00","published_at":"2026-10-24T21:26:38.715842+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2019-1579"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability","summary":"Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-1579","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-1579","aliases":["CVE-2019-1579"],"affected":[],"modified":"2022-01-10T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-134"],"cveID":"CVE-2019-1579","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1579","dueDate":"2022-07-10","product":"PAN-OS","dateAdded":"2022-01-10","vendorProject":"Palo Alto Networks","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Remote Code Execution in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled.","vulnerabilityName":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2019-1579","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":2696,"advisory_id":"a823acaf-3c4a-4fcc-ab76-184dc13c2b6e","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-2021","source_published_at":"2022-03-25T00:00:00+00:00","published_at":"2026-10-24T21:22:36.243488+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2020-2021"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","summary":"Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2020-2021","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2020-2021","aliases":["CVE-2020-2021"],"affected":[],"modified":"2022-03-25T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-347"],"cveID":"CVE-2020-2021","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-2021","dueDate":"2022-04-15","product":"PAN-OS","dateAdded":"2022-03-25","vendorProject":"Palo Alto Networks","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS contains a vulnerability in SAML which allows an attacker to bypass authentication.","vulnerabilityName":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2020-2021","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":1461,"advisory_id":"6464e35d-f691-4fec-9d08-a6dff9f99b5b","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-15944","source_published_at":"2022-08-18T00:00:00+00:00","published_at":"2026-10-24T21:02:49.751752+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2017-15944"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability","summary":"Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2017-15944","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2017-15944","aliases":["CVE-2017-15944"],"affected":[],"modified":"2022-08-18T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2017-15944","notes":"https://security.paloaltonetworks.com/CVE-2017-15944; https://nvd.nist.gov/vuln/detail/CVE-2017-15944","dueDate":"2022-09-08","product":"PAN-OS","dateAdded":"2022-08-18","vendorProject":"Palo Alto Networks","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.","vulnerabilityName":"Palo Alto Networks PAN-OS Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2017-15944","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":1455,"advisory_id":"7f4d79ae-2c42-46bf-9def-08b93b7370b7","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-0028","source_published_at":"2022-08-22T00:00:00+00:00","published_at":"2026-10-24T21:02:45.947887+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2022-0028"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability","summary":"A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2022-0028","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-0028","aliases":["CVE-2022-0028"],"affected":[],"modified":"2022-08-22T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-940"],"cveID":"CVE-2022-0028","notes":"https://security.paloaltonetworks.com/CVE-2022-0028; https://nvd.nist.gov/vuln/detail/CVE-2022-0028","dueDate":"2022-09-12","product":"PAN-OS","dateAdded":"2022-08-22","vendorProject":"Palo Alto Networks","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.","vulnerabilityName":"Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2022-0028","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":1160,"advisory_id":"6b4cd49b-1a58-4254-bb2c-2088ba869a84","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3400","source_published_at":"2024-04-12T00:00:00+00:00","published_at":"2026-10-24T20:57:09.785759+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2024-3400"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Command Injection Vulnerability","summary":"Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall. CISA required action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.","evidence":"kev:CVE-2024-3400","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2024-3400","aliases":["CVE-2024-3400"],"affected":[],"modified":"2024-04-12T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20","CWE-77"],"cveID":"CVE-2024-3400","notes":"https://security.paloaltonetworks.com/CVE-2024-3400 ;   https://nvd.nist.gov/vuln/detail/CVE-2024-3400","dueDate":"2024-04-19","product":"PAN-OS","dateAdded":"2024-04-12","vendorProject":"Palo Alto Networks","requiredAction":"Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.","vulnerabilityName":"Palo Alto Networks PAN-OS Command Injection Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2024-3400","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":1040,"advisory_id":"266daefb-c258-46ec-b8a5-3e11f29ff7f6","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-0012","source_published_at":"2024-11-18T00:00:00+00:00","published_at":"2026-10-24T20:55:09.232368+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2024-0012"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability","summary":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.","evidence":"kev:CVE-2024-0012","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2024-0012","aliases":["CVE-2024-0012"],"affected":[],"modified":"2024-11-18T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-306"],"cveID":"CVE-2024-0012","notes":"https://security.paloaltonetworks.com/CVE-2024-0012 ; https://nvd.nist.gov/vuln/detail/CVE-2024-0012","dueDate":"2024-12-09","product":"PAN-OS","dateAdded":"2024-11-18","vendorProject":"Palo Alto Networks","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, management interface for affected devices should not be exposed to untrusted networks, including the internet.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.","vulnerabilityName":"Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2024-0012","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":1039,"advisory_id":"946bf6c2-fdd4-40e6-9081-59e30f468e27","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9474","source_published_at":"2024-11-18T00:00:00+00:00","published_at":"2026-10-24T20:55:08.62547+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2024-9474"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability","summary":"Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.","evidence":"kev:CVE-2024-9474","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2024-9474","aliases":["CVE-2024-9474"],"affected":[],"modified":"2024-11-18T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-77"],"cveID":"CVE-2024-9474","notes":"https://security.paloaltonetworks.com/CVE-2024-9474 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9474","dueDate":"2024-12-09","product":"PAN-OS","dateAdded":"2024-11-18","vendorProject":"Palo Alto Networks","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Additionally, the management interfaces for affected devices should not be exposed to untrusted networks, including the internet.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.","vulnerabilityName":"Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2024-9474","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":1017,"advisory_id":"07e37fb2-ba4e-46aa-9961-ca9bea18d99a","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-3393","source_published_at":"2024-12-30T00:00:00+00:00","published_at":"2026-10-24T20:54:54.253593+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2024-3393"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability","summary":"Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2024-3393","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2024-3393","aliases":["CVE-2024-3393"],"affected":[],"modified":"2024-12-30T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-754"],"cveID":"CVE-2024-3393","notes":"https://security.paloaltonetworks.com/CVE-2024-3393 ; https://nvd.nist.gov/vuln/detail/CVE-2024-3393","dueDate":"2025-01-20","product":"PAN-OS","dateAdded":"2024-12-30","vendorProject":"Palo Alto Networks","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.","vulnerabilityName":"Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2024-3393","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":483,"advisory_id":"13250fc9-205f-4216-8fdd-82d0cbf21fc4","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0108","source_published_at":"2025-02-18T00:00:00+00:00","published_at":"2026-10-24T20:46:41.282617+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2025-0108"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","summary":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2025-0108","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-0108","aliases":["CVE-2025-0108"],"affected":[],"modified":"2025-02-18T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-306"],"cveID":"CVE-2025-0108","notes":"https://security.paloaltonetworks.com/CVE-2025-0108 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0108","dueDate":"2025-03-11","product":"PAN-OS","dateAdded":"2025-02-18","vendorProject":"Palo Alto Networks","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface. This vulnerability allows an unauthenticated attacker with network access to the management web interface to bypass the authentication normally required and invoke certain PHP scripts.","vulnerabilityName":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2025-0108","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":482,"advisory_id":"e3fcfa39-7f06-4c85-9475-6e4195d8b09c","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0111","source_published_at":"2025-02-20T00:00:00+00:00","published_at":"2026-10-24T20:46:40.690832+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2025-0111"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS File Read Vulnerability","summary":"Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2025-0111","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2025-0111","aliases":["CVE-2025-0111"],"affected":[],"modified":"2025-02-20T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-73"],"cveID":"CVE-2025-0111","notes":"https://security.paloaltonetworks.com/CVE-2025-0111 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0111","dueDate":"2025-03-13","product":"PAN-OS","dateAdded":"2025-02-20","vendorProject":"Palo Alto Networks","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.","vulnerabilityName":"Palo Alto Networks PAN-OS File Read Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2025-0111","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":169,"advisory_id":"5cd59041-736d-4a88-a0a3-a7ad8d0093e4","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0300","source_published_at":"2026-05-06T00:00:00+00:00","published_at":"2026-10-24T20:41:54.153218+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2026-0300"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability","summary":"Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented: - Restrict User-ID Authentication Portal access to only trusted zones. - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.","evidence":"kev:CVE-2026-0300","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-0300","aliases":["CVE-2026-0300"],"affected":[],"modified":"2026-05-06T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-787"],"cveID":"CVE-2026-0300","notes":"https://security.paloaltonetworks.com/CVE-2026-0300 ; https://nvd.nist.gov/vuln/detail/CVE-2026-0300","dueDate":"2026-05-09","product":"PAN-OS","dateAdded":"2026-05-06","vendorProject":"Palo Alto Networks","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Until the vendor releases an official fix, the following workaround should be implemented:  - Restrict User-ID Authentication Portal access to only trusted zones.  - Disable User-ID Authentication Portal if not required. 5/13/2026: Palo Alto has released a variety of patches. If these are relevant to your environment, please apply the designated patch.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.","vulnerabilityName":"Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-0300","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-0300","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"USER","baseScore":9.3,"Automatable":"YES","attackVector":"NETWORK","baseSeverity":"CRITICAL","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red","exploitMaturity":"ATTACKED","providerUrgency":"RED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"scenarios":[{"lang":"en","value":"The risk is highest when you configure the User-ID™ Authentication Portal to enable access from the Internet or any untrusted network."}]},{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"USER","baseScore":8.7,"Automatable":"YES","attackVector":"ADJACENT","baseSeverity":"HIGH","valueDensity":"CONCENTRATED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A/AU:Y/R:U/V:C/RE:M/U:Red","exploitMaturity":"ATTACKED","providerUrgency":"RED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"LOW","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"scenarios":[{"lang":"en","value":"You can greatly reduce the risk of exploitation by restricting User-ID™ Authentication Portal access to only trusted internal IP addresses and preventing its exposure to the internet."}]}],"products":[{"name":{"value":"Cloud NGFW","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"PAN-OS","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Prisma Access","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-0300","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":149,"advisory_id":"abaebae0-d017-4064-8d77-5a93b000d5b7","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0257","source_published_at":"2026-05-29T00:00:00+00:00","published_at":"2026-10-24T20:41:41.752015+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2026-0257"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","summary":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2026-0257","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-0257","aliases":["CVE-2026-0257"],"affected":[],"modified":"2026-05-29T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-565"],"cveID":"CVE-2026-0257","notes":"https://security.paloaltonetworks.com/CVE-2026-0257 ; https://nvd.nist.gov/vuln/detail/CVE-2026-0257","dueDate":"2026-06-01","product":"PAN-OS","dateAdded":"2026-05-29","vendorProject":"Palo Alto Networks","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.","vulnerabilityName":"Palo Alto Networks PAN-OS Authentication Bypass Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2026-0257","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-0257","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"AUTOMATIC","baseScore":7.8,"Automatable":"NO","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N/E:A/AU:N/R:A/V:D/RE:M/U:Red","exploitMaturity":"ATTACKED","providerUrgency":"RED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"HIGH","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","vulnConfidentialityImpact":"LOW","vulnerabilityResponseEffort":"MODERATE"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"Cloud NGFW","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"PAN-OS","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Prisma Access","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-0257","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false},{"id":15,"advisory_id":"da863cc1-7ae2-46e1-baf6-9a488c030186","revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-0322","source_published_at":"2026-10-14T00:00:00+00:00","published_at":"2026-10-24T20:39:28.801251+00:00","extraction_method":"structured","technologies":["core-kev","pan-os"],"cve_ids":["CVE-2026-0322"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Palo Alto Networks PAN-OS Code Injection Vulnerability","summary":"Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-0322","products":[{"name":{"value":"PAN-OS","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-0322","aliases":["CVE-2026-0322"],"affected":[],"modified":"2026-10-14T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-94"],"cveID":"CVE-2026-0322","notes":"https://security.paloaltonetworks.com/CVE-2026-0322 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-0322","dueDate":"2026-10-17","product":"PAN-OS","dateAdded":"2026-10-14","vendorProject":"Palo Alto Networks","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.","vulnerabilityName":"Palo Alto Networks PAN-OS Code Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-0322","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-0322","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"USER","baseScore":8.6,"Automatable":"NO","attackVector":"NETWORK","baseSeverity":"HIGH","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red","exploitMaturity":"ATTACKED","providerUrgency":"RED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"scenarios":[{"lang":"en","value":"The risk is highest when you allow access to the management interface from external IP addresses on the internet. Our recommendation is to remediate as soon as possible."}]},{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"USER","baseScore":8.5,"Automatable":"NO","attackVector":"ADJACENT","baseSeverity":"HIGH","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/AU:N/R:U/V:D/RE:M/U:Red","exploitMaturity":"ATTACKED","providerUrgency":"RED","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"scenarios":[{"lang":"en","value":"You can reduce the risk of exploitation by restricting access to a jump box that is the only system allowed to access the management interface."}]}],"products":[{"name":{"value":"Cloud NGFW","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"PAN-OS","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Prisma Access","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-0322","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"context_update":false}],"next_after":2938,"next_before":15}