CVE-2026-0310
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on PA-Series firewalls. Panorama is also impacted.
Risk Assessment
An organization with an exposed management interface may experience firewall unavailability or full device compromise by a network attacker. The risk is especially high when the management interface is reachable from public networks.
Recommendation
Apply available PAN-OS updates as soon as possible and restrict management interface access to trusted internal IP addresses only, following Palo Alto Networks recommended best practices.
Other vulnerabilities in PAN-OS
See all- CVE-2026-0322HighActively exploited
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. This affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted.
- CVE-2026-0258Critical
An SSRF vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a DoS condition.
- CVE-2026-0264Critical
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition on all PAN-OS platforms except Cloud NGFW and Prisma Access, and potentially execute arbitrary code on PA-Series hardware by sending specially crafted network traffic.
- CVE-2026-0263Critical
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.
- CVE-2025-0111MediumActively exploited
An authenticated attacker with network access to the PAN-OS management web interface can read files on the filesystem that are readable by the 'nobody' user. This issue does not affect Cloud NGFW or Prisma Access.
- CVE-2025-0108CriticalActively exploited
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass authentication and invoke certain PHP scripts. This does not enable remote code execution but can negatively impact integrity and confidentiality.
- CVE-2024-9474HighActively exploited
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. Cloud NGFW and Prisma Access are not impacted by this vulnerability.
- CVE-2024-0012CriticalActively exploited
An authentication bypass in Palo Alto Networks PAN-OS software allows an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges. Affects PAN-OS 10.2, 11.0, 11.1, and 11.2. Risk can be reduced by restricting access to the management interface to trusted IPs.
- CVE-2020-2021CriticalActively exploited
A vulnerability in PAN-OS SAML authentication due to improper signature verification when the 'Validate Identity Provider Certificate' option is disabled. An unauthenticated network-based attacker can access protected resources, and for PAN-OS/Panorama web interfaces, can log in as an administrator. Affects PAN-OS 9.1 < 9.1.3, 9.0 < 9.0.9, 8.1 < 8.1.15, and all 8.0 versions (EOL).
- CVE-2019-1579HighActively exploited
Remote code execution vulnerability in PAN-OS with GlobalProtect Portal or GlobalProtect Gateway Interface enabled. An unauthenticated remote attacker can execute arbitrary code.
Original NVD description (English source)
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama is impacted by this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS