PAN-OS EUVD-2026-30066

Exploitation requires that Cloud Authentication Service (CAS) be enabled on the target PAN-OS device - this is the explicit precondition encoded as AT:P in the CVSS vector and stated by the vendor. Risk is highest when CAS is bound to the management web interface and lower when CAS is used only on other login interfaces (e.g., GlobalProtect or Captive Portal). The attacker must have network reachability to the affected login endpoint, but needs no credentials and no user interaction (PR:N/UI:N). Exploitation is materially constrained when the management interface is restricted to trusted internal IPs per Palo Alto's best-practice hardening guide, and is not possible against Cloud NGFW or Prisma Access, which are not affected.

Signals diverge meaningfully here. The CVSS 4.0 base score of 7.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) reflects a network-reachable, unauthenticated bypass with high confidentiality, integrity, and availability impact, but AT:P (attack requirements present) acknowledges the bypass only works when CAS is enabled - a non-default precondition. EPSS is very low at 0.08% (23rd percentile) and CISA SSVC scores Exploitation: none and Automatable: no with only Partial technical impact, and the bug is not on the KEV list. Practically, this is a serious but conditional issue: organizations that have enabled CAS - especially on the management interface - should treat it as urgent, while deployments using only local or other auth backends on a hardened management plane carry materially lower exposure. The 'Jwt Attack' tag and CWE-347 raise the ceiling on risk because once a working PoC surfaces, JWT-bypass exploitation tends to be cheap and reliable.

An attacker who can reach a PAN-OS management or login interface with CAS enabled crafts an HTTP authentication request carrying a forged or improperly signed JWT-style token; the CAS handler accepts the token without correctly verifying its cryptographic signature and issues an authenticated session. The attacker then operates as a legitimate administrator or user against the firewall or Panorama, with high impact on confidentiality, integrity, and availability of managed configurations and traffic policy. No public exploit identified at time of analysis, but the CWE-347 / JWT pattern is well-trodden and PoCs typically follow quickly after disclosure.