EUVD-2026-42679
GHSA-p684-mjp8-8m27
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Network-facing management interface, no authentication required; impact bounded to temp file deletion with no confidentiality exposure and no scope change.
Primary rating from Vendor (paloaltonetworks).
CVSS VectorVendor: paloaltonetworks
Lifecycle Timeline
3DescriptionCVE.org
A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory.
The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
AnalysisAI
Unauthenticated file deletion in Palo Alto Networks PAN-OS allows network-reachable attackers to delete files from a temporary directory via the management web interface, affecting PA-Series and VM-Series firewalls and Panorama appliances. Real-world risk is substantially bounded by the vendor's documented best-practice guidance to restrict management interface access to trusted internal IP addresses, which eliminates external attack surface. No public exploit code has been identified, CISA KEV listing is absent, and the vendor-provided CVSS 4.0 score of 2.7 with an E:U supplemental metric reflects no known active exploitation.
Technical ContextAI
PAN-OS is Palo Alto Networks' proprietary operating system powering its PA-Series hardware firewalls, VM-Series virtual firewalls, and Panorama management platforms (both virtual appliances and M-Series hardware). The vulnerability resides in the management web interface component and is classified under CWE-20 (Improper Input Validation), indicating that crafted network requests are not sufficiently validated before triggering file deletion operations on the underlying filesystem. The deletion scope is constrained to a temporary directory rather than arbitrary paths, limiting the blast radius. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects that no authentication is required and exploitation is straightforward once the management interface is reachable, while impact metrics (VC:N/VI:L/VA:L and SC:N/SI:N/SA:N) confirm bounded impact with no scope change or confidentiality exposure. Cloud NGFW and Prisma Access are architecturally distinct services and are explicitly confirmed unaffected by the vendor.
RemediationAI
The primary remediation is to apply the vendor-released patch; however, exact patched PAN-OS version numbers are not confirmed in the available data and must be obtained from the Palo Alto Networks Security Advisory at https://security.paloaltonetworks.com/CVE-2026-0282. As an immediate compensating control, restrict access to the PAN-OS management web interface exclusively to trusted internal IP addresses using PAN-OS management interface access control settings - this is Palo Alto's documented deployment best practice and effectively eliminates external attacker reachability for this vulnerability. Additional network-layer controls such as out-of-band management network segmentation, ACLs on upstream routers or switches, and firewall rules blocking inbound access to management ports from untrusted sources provide equivalent defense in depth. Organizations that have already enforced management interface IP restrictions in line with Palo Alto's hardening guidelines are at minimal practical risk from this issue regardless of patch status, though patching remains recommended to eliminate the underlying flaw.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today