EUVD-2026-42676
GHSA-3vmp-6pgh-4q54
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber
Administrator credentials required for management interface access (PR:H, AV:N); SSRF enables internal service probing (C:L) and unauthorized state modification (I:H); no scope change or availability impact.
Primary rating from Vendor (paloaltonetworks).
CVSS VectorVendor: paloaltonetworks
Lifecycle Timeline
3DescriptionCVE.org
A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services.
The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
AnalysisAI
Server-side request forgery in Palo Alto Networks PAN-OS allows an authenticated administrator with access to the management web interface to weaponize the firewall as an unauthorized network relay, making requests to internal services on behalf of the attacker. Exploitation is constrained by the requirement for high-privilege administrator credentials (PR:H) and network reachability to the management interface, substantially limiting the realistic attacker population. No public exploit code or active exploitation has been identified; the vendor's own CVSS 4.0 supplemental metrics rate exploitation status as Unreported (E:U) and urgency as Amber.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) identifies the root cause as insufficient validation of attacker-controlled request destinations within the PAN-OS management web interface, allowing the firewall process to act as a proxy to internal network targets. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H) confirms the attack surface is the network-exposed management web interface with no special attack prerequisites beyond administrator-level credentials. The affected platform is PAN-OS running on physical and virtual next-generation firewalls. The vendor explicitly excludes Panorama, Cloud NGFW, and Prisma Access from impact scope. No CPE strings were included in the source data, so exact affected PAN-OS version ranges must be drawn directly from the vendor advisory.
RemediationAI
Apply the vendor-issued patch for PAN-OS when available; the exact fixed version is not confirmed from the available data - consult the Palo Alto PSIRT advisory at https://security.paloaltonetworks.com/CVE-2026-0285 for specific patched release details as they are published. The most impactful and immediately actionable compensating control - explicitly recommended by Palo Alto as a standing best practice independent of this CVE - is restricting management web interface access to only trusted internal IP addresses via management interface access policies; this eliminates AV:N reachability for unauthorized parties and directly mitigates this vulnerability class for external attackers. Implementation guidance is available at https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431. Note that IP-based restriction does not protect against an attacker who has already compromised a trusted administrator account or a trusted internal host - it addresses external network access, not credential compromise.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today