PAN-OS vulnerabilitiesAnd the versions its exploited flaws hit.
PAN-OS is made by Palo Alto Networks. We track 204 published vulnerabilities in it, across 324 versions. 11 of them are on the list of flaws known to be exploited, the newest added on 20 February 2025. If you run PAN-OS, check your version against the exploited flaws below and patch those first.
The most recent PAN-OS flaw added to the known-exploited list is CVE-2025-0111, on 20 February 2025. We keep watching the known-exploited list.
Which versions of PAN-OS do the exploited flaws hit?
Each exploited flaw lists the versions it affects, usually as ranges. "10.1.0 to before 10.1.14" means from 10.1.0 up to, but not including, 10.1.14. Find your version, then patch.
- CVE-2025-0111Exploited list, 20 Feb 2025
Palo Alto Networks PAN-OS File Read Vulnerability
10.1.0 to before 10.1.1410.1.1410.1.14-h210.1.14-h410.1.14-h610.1.14-h810.2.0 to before 10.2.710.2.7 - CVE-2025-0108Exploited list, 18 Feb 2025
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
10.1.0 to before 10.1.1410.1.1410.1.14-h110.1.14-h210.1.14-h310.1.14-h410.1.14-h510.1.14-h6 - CVE-2024-3393Exploited list, 30 Dec 2024
Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
10.1.1410.1.14-h210.1.14-h410.1.14-h610.2.810.2.8-h310.2.8-h410.2.8-h10 - CVE-2024-0012Exploited list, 18 Nov 2024
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
10.2.010.2.0-h110.2.0-h210.2.0-h310.2.110.2.1-h110.2.1-h210.2.2 - CVE-2024-9474Exploited list, 18 Nov 2024
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
10.1.0 to before 10.1.1410.1.1410.1.14-h210.1.14-h410.2.0 to before 10.2.1210.2.1210.2.12-h111.0.0 to before 11.0.6 - CVE-2024-3400Exploited list, 12 Apr 2024
Palo Alto Networks PAN-OS Command Injection Vulnerability
10.2.010.2.0-h110.2.0-h210.2.110.2.1-h110.2.210.2.2-h110.2.2-h2 - CVE-2022-0028Exploited list, 22 Aug 2022
Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability
8.1.0 to before 8.1.238.1.239.0.0 to before 9.0.169.0.169.0.16-h29.1.0 to before 9.1.149.1.149.1.14-h1 - CVE-2017-15944Exploited list, 18 Aug 2022
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
before 6.1.197.0.0 to before 7.0.197.1.0 to before 7.1.148.0.0 to before 8.0.6 - CVE-2020-2021Exploited list, 25 Mar 2022
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
8.0.0 to 8.0.208.1.0 to before 8.1.159.0.0 to before 9.0.99.1.0 to before 9.1.3 - CVE-2016-5195Exploited list, 3 Mar 2022
Linux Kernel Race Condition Vulnerability
5.1 to before 7.0.147.1.0 to before 7.1.8 - CVE-2019-1579Exploited list, 10 Jan 2022
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
before 7.1.198.0.0 to before 8.0.128.1.0 to before 8.1.3
Which PAN-OS vulnerabilities are being exploited?
11 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 6.5Palo Alto Networks PAN-OS File Read Vulnerability
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability.
- 9.1Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface.
- 7.5Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall.
- 9.8Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
- 7.2Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN...
- 10.0Palo Alto Networks PAN-OS Command Injection Vulnerability
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.
- 8.6Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability
A Palo Alto Networks PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to conduct reflected and amplified TCP denial-of-service (RDoS) attacks.
- 9.8Palo Alto Networks PAN-OS Remote Code Execution Vulnerability
Palo Alto Networks PAN-OS contains multiple, unspecified vulnerabilities which can allow for remote code execution when chained.
Which PAN-OS flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable...
- >99%
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative...
- 98%
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS...
- 98%
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.
- 95%
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
- 86%CVE-2020-2038High
An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges.
- 84%
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory...
- 46%CVE-2020-2039Medium
An uncontrolled resource consumption vulnerability in Palo Alto Networks PAN-OS allows for a remote unauthenticated user to upload temporary files through the management web interface that are not properly deleted...
- 46%
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote...
- 46%CVE-2016-4971High
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.
Running PAN-OS? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
- Matched to
- PAN-OS on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 204 published vulnerabilities listed under the name PAN-OS, across 324 versions. The most recent PAN-OS flaw added to the known-exploited list is CVE-2025-0111, on 20 February 2025.
11 are on the list of flaws known to be exploited. The most recently added are CVE-2025-0111, CVE-2025-0108 and CVE-2024-3393.
Each flaw names its own versions, usually as ranges. The newest, CVE-2025-0111, affects 10.1.0 to before 10.1.14, 10.1.14, 10.1.14-h2, 10.1.14-h4 and more. The versions for every exploited flaw are listed on this page.
Create a Precursor Intelligence account and track PAN-OS. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.