9
CVEs
0
Critical
1
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
1
MEDIUM
5
LOW
3
Monthly CVE Trend
Affected Products (30)
Pan Os
225
Globalprotect
28
Prisma Access
21
Cloud Ngfw
16
Cortex Xdr Agent
15
Windows
13
Expedition
12
Globalprotect App
10
Prisma Access Agent
8
Cortex Xsoar
8
macOS
7
Prisma Browser
6
Jwt Attack
5
Chrome
4
Android
4
Traps
4
Prisma Cloud
3
Terminal Services Agent
3
Globalprotect Uwp App
2
Cortex Xdr Broker Vm
2
Fedora
2
PHP
2
Session Fixation
2
Checkov By Prisma Cloud
2
Prisma Sd Wan Ion
2
Open Redirect
1
Broker Vm
1
Twistlock
1
Global Protected Gateway
1
Vm Series
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-0310 | Buffer overflow in the XML processing stack of Palo Alto Networks PAN-OS enables unauthenticated remote attackers to cause denial of service on VM-Series virtual firewalls or execute arbitrary code with root privileges on PA-Series physical appliances. The vulnerability is reachable via the management web interface or dataplane interface, and Panorama management platforms are also confirmed in scope. No public exploit has been identified at time of analysis; the CVSS 4.0 supplemental metric E:U corroborates no known active exploitation. | HIGH | 7.2 | 0.3% | 36 |
|
| CVE-2026-0307 | Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected. | MEDIUM | 5.9 | 0.1% | 30 |
|
| CVE-2026-0306 | DLP policy enforcement bypass in Palo Alto Networks Prisma Access Agent on Windows allows a low-privileged local user to circumvent configured EndPoint Data Loss Prevention controls and exfiltrate sensitive data that configured policy should block. The vulnerability is explicitly scoped to Windows deployments only - macOS, Linux, iOS, Android, and Chrome OS agents are confirmed unaffected by the vendor. No public exploit code is identified at time of analysis, and the CVSS 4.0 exploitation metric (E:U) indicates no observed active exploitation. | MEDIUM | 5.8 | 0.1% | 29 |
|
| CVE-2026-0304 | Privilege escalation to root on Palo Alto Networks Cortex XDR Broker VM is achievable by an authenticated low-privileged user who simultaneously holds a man-in-the-middle position on the adjacent network segment. The underlying flaw is argument injection (CWE-88), allowing the attacker to manipulate command-line arguments processed by the Broker VM to gain root-level code execution on the appliance. No public exploit has been identified (CVSS 4.0 E:U, Urgency: Amber), and Palo Alto Networks has published an advisory at security.paloaltonetworks.com. | MEDIUM | 4.8 | 0.2% | 24 |
|
| CVE-2026-0305 | Information disclosure in the Palo Alto Networks Prisma® Access Agent on Linux allows local low-privileged users to read sensitive configuration data and credentials stored by the agent process. Only the Linux platform is affected; Palo Alto Networks has explicitly confirmed that macOS, Windows, iOS, Android, and Chrome OS deployments are not impacted. No public exploit code and no active exploitation have been identified; the CVSS 4.0 vector carries an E:U (unexploited) modifier. | MEDIUM | 4.3 | 0.1% | 22 |
|
| CVE-2026-0309 | Command injection in Palo Alto Networks PAN-OS allows an authenticated administrator to escape CLI restrictions and execute arbitrary OS commands as root via CWE-78 weaknesses in the Luna Hardware Security Module integration pathway. Exploitation is doubly gated: the attacker must hold administrative credentials with CLI access, and the target device must be configured with a Luna HSM - a niche cryptographic hardware module rarely deployed outside regulated or high-assurance environments. Panorama, Cloud NGFW, and Prisma Access are explicitly confirmed unaffected; vendor-released patches exist across all supported PAN-OS branches, and no public exploit or active exploitation has been identified. | MEDIUM | 4.0 | 0.4% | 20 |
|
| CVE-2026-0303 | Arbitrary code execution in Palo Alto Networks Checkov - the Prisma Cloud IaC static-analysis scanner - triggers when the tool scans a directory containing an attacker-crafted configuration file. The vulnerability is rooted in CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): Checkov loads and evaluates IaC configuration files without sufficient isolation, allowing embedded attacker-controlled logic to execute in the scanner's runtime context. The most consequential attack surface is CI/CD pipelines, where Checkov runs automated scans with access to cloud credentials and secrets, making successful exploitation a pathway to subsequent-system compromise even though the primary vulnerable-system impact is limited. No public exploit code has been identified and Palo Alto rates exploit maturity as unreported (E:U). | LOW | 2.4 | 0.1% | 12 |
|
| CVE-2026-0302 | OS command injection in Palo Alto Networks Checkov by Prisma Cloud allows a local low-privileged user to execute arbitrary commands within the Checkov scanning process. Because Checkov is routinely deployed inside CI/CD pipelines holding cloud credentials and infrastructure deployment permissions, successful exploitation can propagate beyond the scanning host to affect subsequent systems at high confidentiality, integrity, and availability impact. No public exploit has been identified and Palo Alto Networks' own environmental scoring (1.1) reflects both the local-only attack vector and currently unreported exploitation activity. | LOW | 1.1 | 0.8% | 6 |
|
| CVE-2026-0308 | Palo Alto Networks PAN-OS web interface on PA-Series and VM-Series firewalls and Panorama management platforms contains a stored cross-site scripting vulnerability that enables an authenticated administrator to inject persistent JavaScript payloads into the management UI, which execute in the browsers of other administrators who view the affected pages. Affected versions span PAN-OS 11.1.x through 12.1.x; Cloud NGFW and Prisma Access are explicitly not affected. No public exploit has been identified, and the CVSS 4.0 score of 1.1 reflects the narrow exploitation conditions: administrator-level credentials are required along with passive interaction by a second administrator. | LOW | 1.1 | 0.3% | 6 |
|