Product by Palo Alto Networks
Pan-os
197 known vulnerabilities in Pan-os (Palo Alto Networks), 11 of them actively exploited (CISA KEV).
Key figures
197
Vulnerabilities
11
Actively exploited (KEV)
5
Used by ransomware
23
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-0257 | PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities In CISA KEVRansomwarealso in 4 other products | 9.1 | |
| Critical | CVE-2024-0012 | PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015) In CISA KEVRansomwarealso in 1 other product | 9.8 | |
| Critical | CVE-2024-3400 | PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect In CISA KEVRansomwarealso in 1 other product | 10.0 | |
| Critical | CVE-2024-9474 | PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface In CISA KEVRansomwarealso in 1 other product | 7.2 | |
| Critical | CVE-2026-0300 | Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability In CISA KEValso in 2 other products | 9.8 | |
| Critical | CVE-2020-2021 | PAN-OS: Authentication Bypass in SAML Authentication In CISA KEVRansomwarealso in 1 other product | 10.0 | |
| Critical | CVE-2025-0108 | PAN-OS: Authentication Bypass in the Management Web Interface In CISA KEValso in 1 other product | 9.1 | |
| Critical | CVE-2024-3393 | PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet In CISA KEValso in 2 other products | 7.5 | |
| Critical | CVE-2026-0322 | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface In CISA KEValso in 6 other products | 7.2 | |
| Critical | CVE-2022-0028 | PAN-OS: Reflected Amplification Denial-of-Service (DoS) Vulnerability in URL Filtering In CISA KEValso in 1 other product | 8.6 | |
| Critical | CVE-2025-0111 | PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface In CISA KEValso in 1 other product | 6.5 | |
| Critical | CVE-2021-3064 | PAN-OS: Memory Corruption Vulnerability in GlobalProtect Portal and Gateway Interfaces | 9.8 | |
| High | CVE-2020-2036 | PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface | 8.8 | |
| High | CVE-2021-3060 | PAN-OS: OS Command Injection in Simple Certificate Enrollment Protocol (SCEP) | 8.1 | |
| High | CVE-2020-2038 | PAN-OS: OS command injection vulnerability in the management web interface | 7.2 | |
| Critical | CVE-2020-2040 | PAN-OS: Buffer overflow when Captive Portal or Multi-Factor Authentication (MFA) is enabled | 9.8 | |
| High | CVE-2020-2034 | PAN-OS: OS command injection vulnerability in GlobalProtect portal | 8.1 | |
| Critical | CVE-2019-1581 | PAN-OS: Remote code execution vulnerability in the PAN-OS SSH device management interface | 9.8 | |
| Medium | CVE-2020-2039 | PAN-OS: Management web interface denial-of-service (DoS) through unauthenticated file upload | 5.3 | |
| Critical | CVE-2020-1992 | PAN-OS on PA-7000 Series: Varrcvr daemon network-based denial of service or privilege escalation | 8.1 | |
| High | CVE-2026-0286 | PAN-OS: Authenticated Command Injection in CLI | 7.2 | |
| High | CVE-2020-2014 | PAN-OS: OS injection vulnerability in PAN-OS management server | 8.8 | |
| High | CVE-2020-2037 | PAN-OS: OS command injection vulnerability in the management web interface | 7.2 | |
| High | CVE-2020-2000 | PAN-OS: OS command injection and memory corruption vulnerability | 7.2 | |
| Critical | CVE-2019-17440 | Palo Alto Networks PAN-OS: Improper Restriction of Communication Channel to Intended Endpoints | 10.0 |
News
- Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFAthehackernews,
- Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fixcsoonline,
- Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitationthehackernews,
- Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacksbleepingcomputer,
- Ransomware groups are hammering your vulnerable VPNscsoonline,
- Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Accessthehackernews,