Palo Alto Networks vulnerabilities14 known to be exploited.
Palo Alto Networks has 292 published vulnerabilities across 67 products in our catalogue. 14 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is PAN-OS, with 204. If you run Palo Alto Networks software, patch the exploited flaws first.
The most recent Palo Alto Networks flaw added to the known-exploited list is CVE-2025-0111, on 20 February 2025. We keep watching the known-exploited list.
Which Palo Alto Networks products have the most vulnerabilities?
PAN-OS leads with 204 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Palo Alto Networks vulnerabilities are being exploited?
14 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 6.5Palo Alto Networks PAN-OS File Read Vulnerability
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability.
- 9.1Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in its management web interface.
- 7.5Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability
Palo Alto Networks PAN-OS contains a vulnerability in parsing and logging malicious DNS packets in the DNS Security feature that, when exploited, allows an unauthenticated attacker to remotely reboot the firewall.
- 9.8Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
- 7.2Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN...
- 9.9Palo Alto Networks Expedition OS Command Injection Vulnerability
Palo Alto Networks Expedition contains an OS command injection vulnerability that allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext...
- 9.2Palo Alto Networks Expedition SQL Injection Vulnerability
Palo Alto Networks Expedition contains a SQL injection vulnerability that allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and...
- 9.3Palo Alto Networks Expedition Missing Authentication Vulnerability
Palo Alto Networks Expedition contains a missing authentication vulnerability that allows an attacker with network access to takeover an Expedition admin account and potentially access configuration secrets,...
Which Palo Alto Networks flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable...
- >99%
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative...
- >99%
An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys.
- 99%
An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords,...
- 98%
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS...
- 98%
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface.
- 95%
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges.
- 92%
Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition.
- 86%CVE-2020-2038High
An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges.
- 84%
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory...
All Palo Alto Networks products we track.
16 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- PAN-OSpan-os204 vulnerabilities324 versions
- Globalprotectglobalprotect28 vulnerabilities69 versions
- Cortex XDR Agentcortex_xdr_agent19 vulnerabilities59 versions
- Expeditionexpedition11 vulnerabilities229 versions
- Cortex Xsoarcortex_xsoar9 vulnerabilities11 versions
- Prisma Accessprisma_access6 vulnerabilities11 versions
- Prisma Cloudprisma_cloud4 vulnerabilities36 versions
- Expedition Migration Toolexpedition_migration_tool3 vulnerabilities13 versions
- Terminal Services Agentterminal_services_agent3 vulnerabilities5 versions
- Trapstraps3 vulnerabilities8 versions
- Bridgecrew Checkovbridgecrew_checkov2 vulnerabilities142 versions
- Demistodemisto1 vulnerability1 version
- Minemeldminemeld1 vulnerability1 version
- Twistlocktwistlock1 vulnerability2 versions
- VM-Seriesvm-series1 vulnerability3 versions
- Panorama Virtual Appliancepanorama_virtual_appliance0 vulnerabilities1 version
This directory lists the 16 Palo Alto Networks products with at least one tracked version, of 67 in our catalogue.
Running Palo Alto Networks? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Palo Alto Networks PAN-OS contains an external control of file name or path vulnerability. Successful exploitation enables an authenticated attacker with network access to the management web interface to read files on the PAN-OS filesystem that are readable by the “nobody” user.
- Matched to
- PAN-OS on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 292 published vulnerabilities across 67 products and 915 versions from Palo Alto Networks. The most recent Palo Alto Networks flaw added to the known-exploited list is CVE-2025-0111, on 20 February 2025.
14 Palo Alto Networks vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2025-0111, CVE-2025-0108 and CVE-2024-3393. The full list is on this page.
PAN-OS, with 204 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Palo Alto Networks products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.