CVE-2026-0282
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A file deletion vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory. This issue affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series).
Risk Assessment
The risk for the organization is the potential for unauthorized deletion of temporary files, which could disrupt device operation or be leveraged in further attacks. The risk is minimized by restricting management interface access to trusted internal IP addresses.
Recommendation
It is recommended to restrict access to the management web interface to only trusted internal IP addresses following Palo Alto Networks best practices. Also, apply available security updates from the vendor.
Other vulnerabilities in PAN-OS
See all- CVE-2026-0258Critical
An SSRF vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a DoS condition.
- CVE-2026-0264Critical
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition on all PAN-OS platforms except Cloud NGFW and Prisma Access, and potentially execute arbitrary code on PA-Series hardware by sending specially crafted network traffic.
- CVE-2026-0263Critical
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.
- CVE-2025-0111MediumActively exploited
An authenticated attacker with network access to the PAN-OS management web interface can read files on the filesystem that are readable by the 'nobody' user. This issue does not affect Cloud NGFW or Prisma Access.
- CVE-2025-0108CriticalActively exploited
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass authentication and invoke certain PHP scripts. This does not enable remote code execution but can negatively impact integrity and confidentiality.
- CVE-2024-9474HighActively exploited
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- CVE-2024-0012CriticalActively exploited
An authentication bypass in Palo Alto Networks PAN-OS software allows an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges. Affects PAN-OS 10.2, 11.0, 11.1, and 11.2. Risk can be reduced by restricting access to the management interface to trusted IPs.
- CVE-2020-2021CriticalActively exploited
A vulnerability in PAN-OS SAML authentication due to improper signature verification when the 'Validate Identity Provider Certificate' option is disabled. An unauthenticated network-based attacker can access protected resources, and for PAN-OS/Panorama web interfaces, can log in as an administrator. Affects PAN-OS 9.1 < 9.1.3, 9.0 < 9.0.9, 8.1 < 8.1.15, and all 8.0 versions (EOL).
- CVE-2019-1579HighActively exploited
Remote code execution vulnerability in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. An unauthenticated remote attacker can execute arbitrary code.
- CVE-2026-0310High
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on PA-Series firewalls. Panorama is also impacted.
Original NVD description (English source)
A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory. The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS