PAN-OS

The US cybersecurity agency CISA lists these vulnerabilities in its catalog of Known Exploited Vulnerabilities. Check your version and patch or mitigate promptly.

• CVE-2020-2021Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityRansomware

  10.0 critical · over the network, without login · CISA deadline was 15 Apr 22

• CVE-2024-3400Palo Alto Networks PAN-OS Command Injection VulnerabilityRansomware

  10.0 critical · over the network, without login · CISA deadline was 19 Apr 24

• CVE-2024-0012Palo Alto Networks PAN-OS Management Interface Authentication Bypass VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 9 Dec 24

• CVE-2026-0257Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityRansomware

  9.1 critical · over the network, without login · CISA deadline was 1 Jun

• CVE-2019-1579Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityRansomware

  8.1 high · over the network, without login · CISA deadline was 10 Jul 22

• CVE-2024-9474Palo Alto Networks PAN-OS Management Interface OS Command Injection VulnerabilityRansomware

  7.2 high · over the network, with admin rights only · CISA deadline was 9 Dec 24

• CVE-2017-15944Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 8 Sept 22

• CVE-2026-0300Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 9 May

• CVE-2025-0108Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

  9.1 critical · over the network, without login · CISA deadline was 11 Mar 25

• CVE-2022-0028Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability

  8.6 high · over the network, without login · CISA deadline was 12 Sept 22

• CVE-2024-3393Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

  7.5 high · over the network, without login · CISA deadline was 20 Jan 25

• CVE-2025-0111Palo Alto Networks PAN-OS File Read Vulnerability

  6.5 medium · over the network, with a basic account · CISA deadline was 13 Mar 25

Source: CISA KEV. The CVE is matched to the product automatically — when in doubt, the linked NVD entry applies.