CVE-2026-0280
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
An IPv6 packet processing vulnerability in the dataplane of PAN-OS allows an unauthenticated attacker to bypass firewall security policies, enabling blocked traffic to reach protected services. This issue affects only Palo Alto Networks firewalls, not Cloud NGFW or Panorama.
Risk Assessment
The risk involves unauthorized network traffic bypassing security policies, potentially compromising the confidentiality and integrity of protected assets.
Recommendation
Immediately update PAN-OS to a patched version and review IPv6 rule configurations.
Other vulnerabilities in PAN-OS
See all- CVE-2026-0258Critical
An SSRF vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a DoS condition.
- CVE-2026-0264Critical
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition on all PAN-OS platforms except Cloud NGFW and Prisma Access, and potentially execute arbitrary code on PA-Series hardware by sending specially crafted network traffic.
- CVE-2026-0263Critical
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.
- CVE-2025-0111MediumActively exploited
An authenticated attacker with network access to the PAN-OS management web interface can read files on the filesystem that are readable by the 'nobody' user. This issue does not affect Cloud NGFW or Prisma Access.
- CVE-2025-0108CriticalActively exploited
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass authentication and invoke certain PHP scripts. This does not enable remote code execution but can negatively impact integrity and confidentiality.
- CVE-2024-9474HighActively exploited
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- CVE-2024-0012CriticalActively exploited
An authentication bypass in Palo Alto Networks PAN-OS software allows an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges. Affects PAN-OS 10.2, 11.0, 11.1, and 11.2. Risk can be reduced by restricting access to the management interface to trusted IPs.
- CVE-2020-2021CriticalActively exploited
A vulnerability in PAN-OS SAML authentication due to improper signature verification when the 'Validate Identity Provider Certificate' option is disabled. An unauthenticated network-based attacker can access protected resources, and for PAN-OS/Panorama web interfaces, can log in as an administrator. Affects PAN-OS 9.1 < 9.1.3, 9.0 < 9.0.9, 8.1 < 8.1.15, and all 8.0 versions (EOL).
- CVE-2019-1579HighActively exploited
Remote code execution vulnerability in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. An unauthenticated remote attacker can execute arbitrary code.
- CVE-2026-0310High
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on PA-Series firewalls. Panorama is also impacted.
Original NVD description (English source)
An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services. Cloud NGFW and Panorama are not impacted by this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS