WildFire WF-500 CVE-2026-0259

Exploitation requires: (1) the target appliance is a WF-500 or WF-500-B hardware model running Palo Alto WildFire software in the default non-FIPS configuration mode - appliances explicitly switched to FIPS mode are not affected per the vendor description; (2) the attacker holds a valid low-privilege authenticated account (PR:L per CVSS 4.0 vector) on the appliance; (3) network-level access to the appliance's interface from which the vulnerable request can be submitted (AV:N). What limits exploitation: the authentication requirement (PR:L) means unauthenticated internet-facing exploitation is not possible - an insider, a compromised credential, or a legitimate low-privilege account is required; the FIPS mode configuration exclusion means organizations that have explicitly hardened appliances to FIPS compliance are not at risk; the WildFire Public cloud service is entirely unaffected. The SSVC 'automatable: no' rating further indicates mass automated exploitation across target populations is not feasible under current conditions.

The CVSS 4.0 score of 5.0 reflects a network-reachable (AV:N), low-complexity (AC:L) vulnerability requiring low-level authenticated access (PR:L) with no user interaction (UI:N), yielding high confidentiality impact on the vulnerable component (VC:H) but only low integrity impact (VI:L) and no availability impact (VA:N). The exploit maturity modifier E:U (unexploited) in the CVSS vector directly reduces the effective score. EPSS at 0.05% (16th percentile) is very low, indicating mass automated exploitation is statistically unlikely. SSVC confirms: exploitation=none, automatable=no, technical impact=partial - all signals converge on a moderate but not urgent priority. The high VC:H rating is the primary concern: sensitive files on a sandboxing appliance could include malware analysis results, network configuration, credentials, or submission metadata, representing meaningful intelligence value to an insider threat or compromised low-privilege account. The delete capability introduces operational risk but CVSS VA:N suggests the NVD/vendor did not score availability as a primary concern. No conflicting signals between CVSS, EPSS, and SSVC were identified.

An authenticated user with low-privileged access to a WF-500 appliance - such as an analyst account or a compromised service credential - crafts a network request supplying a manipulated file path to a vulnerable endpoint on the appliance's management interface. The appliance uses this attacker-controlled path without proper sanitization (CWE-73), enabling the user to read sensitive files such as configuration data, analysis results, or internal credentials, and to delete targeted files outside their authorized scope. No public exploit code has been identified at time of analysis, so exploitation currently requires independent discovery of the vulnerable endpoint and parameter.