What happened
Palo Alto Networks Unit 42 has disclosed a new autonomous vulnerability discovery system it calls NOVA, or Network and Open-Source Vulnerability Analyzer. The agentic research system uses proprietary AI harnesses powered by multiple leading frontier AI models to find, validate, and report vulnerabilities in open-source software without a human in the loop until final review.
In two months, NOVA analyzed 3,915 open-source projects and confirmed 14,090 vulnerabilities. Unit 42 says 99.4% of the findings were previously unreported, and 40% are rated high or critical severity. The team also identified three CVEs: CVE-2025-40947, CVE-2025-40948, and CVE-2026-0257, covering PAN-OS and ROX II.
For each project, NOVA reviewed the project history, read the source code, identified vulnerability candidates, created a working proof of concept, and performed deterministic validation. Unit 42 notes that under CVSS 3.1, 4,030 findings (28.6%) scored High or Critical, while under CVSS 4.0, 5,600 findings (39.7%) hit that threshold.
Technical details
NOVA operates as a fully autonomous agentic system that processes each target through five sequential stages: project history review, source code reading, vulnerability candidate identification, working proof-of-concept generation, and deterministic validation. No human intervenes until final review, at which point the team confirms the PoC and assigns a CVE.
The three disclosed CVEs cover two distinct targets. CVE-2025-40947 and CVE-2025-40948 affect PAN-OS, while CVE-2026-0257 hits ROX II. Unit 42 did not publish a separate CVSS vector or EPSS score for any of the three in this disclosure; the 14,090 confirmed findings are scored under both CVSS 3.1 and 4.0, with 4,030 (28.6%) and 5,600 (39.7%) landing at High or Critical respectively.
The vulnerability mix skews toward memory and calculation bugs. In Unit 42's taxonomy, memory and calculation issues account for 557 findings (4.0% of the total), with resource-management and denial-of-service issues making up the remainder. That is a meaningful step beyond prior automated scanners, which typically surface a long tail of low-impact issues.
Who is affected
The three disclosed CVEs cover two distinct targets: PAN-OS (CVE-2025-40947 and CVE-2025-40948) and ROX II (CVE-2026-0257). Unit 42 did not publish a separate CVSS vector or EPSS score for any of the three in this disclosure; the 14,090 confirmed findings are scored under both CVSS 3.1 and 4.0, with 4,030 (28.6%) and 5,600 (39.7%) landing at High or Critical respectively.
The vulnerability mix skews toward memory and calculation bugs. In Unit 42's taxonomy, memory and calculation issues account for 557 findings (4.0% of the total), with resource-management and denial-of-service issues making up the remainder. That is a meaningful step beyond prior automated scanners, which typically surface a long tail of low-impact issues.
What to do
Palo Alto Networks recommends that organizations apply the three disclosed CVEs to PAN-OS and ROX II as soon as vendor patches land, then verify the fix against the provided proof-of-concept. For PAN-OS, deploy the updated build and confirm the CVE-2025-40947 and CVE-2025-40948 fixes; for ROX II, apply the patch covering CVE-2026-0257. Unit 42 did not publish a separate CVSS vector or EPSS score for any of the three in this disclosure, so treat the 14,090 confirmed findings as the primary severity signal — 4,030 (28.6%) score High or Critical under CVSS 3.1, and 5,600 (39.7%) under CVSS 4.0.
For detection, add the three CVE IDs to your scanner or SCA pipeline and watch for the PoC execution pattern. The vulnerability mix skews toward memory and calculation bugs — 557 findings (4.0% of the total) in Unit 42's taxonomy — with resource-management and denial-of-service issues making up the remainder. That is a meaningful step beyond prior automated scanners, which typically surface a long tail of low-impact issues.
Palo Alto Networks recommends that organizations deploy relevant best practices, including vulnerability management, zero-trust network architecture, software supply chain security, and other attack surface reduction best practices. The patch window has collapsed: when vulnerability discovery accelerates, the time between disclosure and potential exploitation shrinks dramatically, and attackers need not have a full RCE to start probing.
Key points
- NOVA is a fully autonomous agentic system that reviews project history, reads source code, identifies candidates, generates a working PoC, and deterministically validates each vulnerability without a human in the loop until final review.
- In two months, NOVA analyzed 3,915 OSS projects and confirmed 14,090 vulnerabilities: 99.4% previously unreported, 40% high/critical severity.
- Under CVSS 3.1, 4,030 findings (28.6%) scored High/Critical; under CVSS 4.0, 5,600 findings (39.7%) scored High/Critical.
- Memory and calculation issues — the closest prior-automation category — accounted for only 557 findings (4.0%), showing NOVA goes deeper than previous automated scanners.
- Unit 42 says the patch window has collapsed: the time between disclosure and exploitation shrks dramatically, and attackers no longer need to be human to find and exploit these bugs.