33
CVEs
0
Critical
2
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
17
LOW
14
Monthly CVE Trend
Affected Products (30)
Pan Os
225
Globalprotect
28
Prisma Access
21
Cloud Ngfw
16
Cortex Xdr Agent
15
Windows
13
Expedition
12
Globalprotect App
10
Prisma Access Agent
8
Cortex Xsoar
8
macOS
7
Prisma Browser
6
Jwt Attack
5
Chrome
4
Android
4
Traps
4
Prisma Cloud
3
Terminal Services Agent
3
Globalprotect Uwp App
2
Cortex Xdr Broker Vm
2
Fedora
2
PHP
2
Session Fixation
2
Checkov By Prisma Cloud
2
Prisma Sd Wan Ion
2
Open Redirect
1
Broker Vm
1
Twistlock
1
Global Protected Gateway
1
Vm Series
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-0288 | Memory corruption in the User-ID Terminal Server Agent (TSA) of Palo Alto Networks PAN-OS lets an unauthenticated network attacker crash the service (DoS) or potentially execute arbitrary code by sending crafted traffic to the TSA listener. Multiple out-of-bounds write bugs are involved; the vendor's CVSS 4.0 vector flags the exploit as unproven (E:U), and no public exploit has been identified at time of analysis. Panorama is explicitly not affected, and exposure hinges on whether the optional TSA component is deployed and reachable. | HIGH | 7.2 | 0.5% | 37 |
|
| CVE-2026-0310 | Buffer overflow in the XML processing stack of Palo Alto Networks PAN-OS enables unauthenticated remote attackers to cause denial of service on VM-Series virtual firewalls or execute arbitrary code with root privileges on PA-Series physical appliances. The vulnerability is reachable via the management web interface or dataplane interface, and Panorama management platforms are also confirmed in scope. No public exploit has been identified at time of analysis; the CVSS 4.0 supplemental metric E:U corroborates no known active exploitation. | HIGH | 7.2 | 0.3% | 36 |
|
| CVE-2026-0287 | Denial of service conditions in Palo Alto Networks PAN-OS allow unauthenticated network attackers to crash firewall dataplane processes by sending specially crafted traffic to or through a dataplane interface. Repeated exploitation escalates the impact: the firewall is forced into maintenance mode, effectively taking the security appliance offline and disrupting all traffic enforcement. No public exploit code has been identified at time of analysis, and Panorama management infrastructure is explicitly confirmed unaffected. | MEDIUM | 6.6 | 0.5% | 34 |
|
| CVE-2026-0286 | Command injection in the Palo Alto Networks PAN-OS management plane allows an authenticated administrator to execute arbitrary OS commands with root privileges on PA-Series, VM-Series, and Panorama appliances. The vulnerability is classified CWE-78 and is reachable via the network-accessible management interface, though the requirement for administrator-level credentials substantially constrains the attacker pool. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV. | MEDIUM | 6.0 | 1.1% | 31 |
|
| CVE-2026-0294 | Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments. | MEDIUM | 6.0 | 0.1% | 30 |
|
| CVE-2026-0299 | Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement. | MEDIUM | 5.9 | 0.2% | 30 |
|
| CVE-2026-0307 | Multiple local privilege escalation flaws in Palo Alto Networks GlobalProtect App on Windows, macOS, and Linux allow any authenticated local user to elevate privileges to NT AUTHORITY\SYSTEM or root. The root cause is CWE-426 (Untrusted Search Path), a class of vulnerability commonly manifesting as DLL search-order hijacking or PATH manipulation that the privileged VPN client process follows. No public exploit is known at time of analysis, and Palo Alto has released fixed versions; iOS, Android, and ChromeOS deployments are explicitly not affected. | MEDIUM | 5.9 | 0.1% | 30 |
|
| CVE-2026-0306 | DLP policy enforcement bypass in Palo Alto Networks Prisma Access Agent on Windows allows a low-privileged local user to circumvent configured EndPoint Data Loss Prevention controls and exfiltrate sensitive data that configured policy should block. The vulnerability is explicitly scoped to Windows deployments only - macOS, Linux, iOS, Android, and Chrome OS agents are confirmed unaffected by the vendor. No public exploit code is identified at time of analysis, and the CVSS 4.0 exploitation metric (E:U) indicates no observed active exploitation. | MEDIUM | 5.8 | 0.1% | 29 |
|
| CVE-2026-0293 | Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain unauthorized access to the agent's protected processes and files, effectively disabling endpoint security enforcement. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly not impacted. No public exploit code has been identified and no active exploitation has been confirmed (CVSS E:U), keeping real-world risk constrained to insider threat and post-compromise scenarios. | MEDIUM | 5.6 | 0.1% | 28 |
|
| CVE-2026-0298 | Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature. | MEDIUM | 5.2 | 0.2% | 26 |
|
| CVE-2026-0297 | Out-of-bounds write in Palo Alto Networks GlobalProtect app exposes Windows, macOS, and Linux endpoints to arbitrary code execution at SYSTEM or root privilege levels when clients connect to an attacker-controlled rogue gateway or are subjected to a man-in-the-middle attack. The vulnerability resides in the client-side VPN agent's processing of gateway-supplied data, where a crafted response can corrupt memory and hijack execution. No public exploit has been identified at time of analysis, and CISA has not confirmed active exploitation, but full confidentiality, integrity, and availability compromise is possible on any affected endpoint that connects through a manipulated gateway. | MEDIUM | 5.2 | 0.2% | 26 |
|
| CVE-2026-0304 | Privilege escalation to root on Palo Alto Networks Cortex XDR Broker VM is achievable by an authenticated low-privileged user who simultaneously holds a man-in-the-middle position on the adjacent network segment. The underlying flaw is argument injection (CWE-88), allowing the attacker to manipulate command-line arguments processed by the Broker VM to gain root-level code execution on the appliance. No public exploit has been identified (CVSS 4.0 E:U, Urgency: Amber), and Palo Alto Networks has published an advisory at security.paloaltonetworks.com. | MEDIUM | 4.8 | 0.2% | 24 |
|
| CVE-2026-0284 | XML injection in Palo Alto Networks PAN-OS Large Scale VPN (LSVPN) exposes unauthenticated remote attackers a path to inject malicious XML content into the LSVPN data pipeline, resulting in information disclosure or corruption of internal satellite configuration data. Only PAN-OS devices with LSVPN actively configured are affected; the vendor explicitly confirms Panorama, Cloud NGFW, and Prisma Access are not in scope. No public exploit has been identified at time of analysis, and the CVSS 4.0 supplemental E:U metric signals exploitation as currently unlikely, though the zero-authentication, network-accessible attack surface demands prompt attention from operators running LSVPN hub deployments. | MEDIUM | 4.7 | 0.5% | 24 |
|
| CVE-2026-0285 | Server-side request forgery in Palo Alto Networks PAN-OS allows an authenticated administrator with access to the management web interface to weaponize the firewall as an unauthorized network relay, making requests to internal services on behalf of the attacker. Exploitation is constrained by the requirement for high-privilege administrator credentials (PR:H) and network reachability to the management interface, substantially limiting the realistic attacker population. No public exploit code or active exploitation has been identified; the vendor's own CVSS 4.0 supplemental metrics rate exploitation status as Unreported (E:U) and urgency as Amber. | MEDIUM | 4.7 | 0.5% | 24 |
|
| CVE-2026-0283 | Authentication bypass in the Large Scale VPN (LSVPN) feature of Palo Alto Networks PAN-OS enables unauthenticated network-adjacent attackers to establish unauthorized site-to-site VPN connections without valid credentials. The root cause is CWE-306 (Missing Authentication for Critical Function), where the LSVPN peer negotiation process fails to enforce authentication before allowing VPN tunnel establishment. While the CVSS 4.0 base score is 4.5, the subsequent-system confidentiality impact is rated High (SC:H), reflecting that a successful bypass grants the attacker routing-level access into networks protected by the VPN - a materially greater risk than the headline score suggests. No public exploit code exists and no active exploitation has been confirmed (CISA KEV not listed, E:U). | MEDIUM | 4.5 | 0.6% | 23 |
|