Palo Alto PAN-OS vulnerabilities and fixes

CVEs that mention Palo Alto PAN-OS, ranked by priority. 14 tracked.

Palo Alto PAN-OS has 14 tracked vulnerabilities, 1 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 14. Most recent: 2026-10-21. Highest priority: CVE-2026-109618 (score 71/100).

• CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
• CVE-2026-0322 HIGH 7.2 EXPLOITED UPGRADE Palo Alto Networks PAN-OS Code Injection Vulnerability
• CVE-2026-109619 HIGH 8.1 UPGRADE MITIGATE PHP has various global state that temporarily points into request memory
• CVE-2026-0298 HIGH 8.1 UPGRADE An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of
• CVE-2026-0297 HIGH 8.1 UPGRADE UPGRADE A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-
• CVE-2026-0296 HIGH 7.4 UPGRADE UPGRADE Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthentic
• CVE-2026-0299 HIGH 7.8 UPGRADE UPGRADE Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to
• CVE-2026-0294 HIGH 7.8 UPGRADE A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and ma
• CVE-2026-0289 MEDIUM 6.5 UPGRADE A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enabl
• CVE-2026-0295 HIGH 7.0 UPGRADE A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-
• CVE-2026-0292 MEDIUM 6.0 UPGRADE An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Win
• CVE-2026-0293 MEDIUM 6.0 UPGRADE A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administra
• CVE-2026-0290 MEDIUM 5.5 UPGRADE An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Brows
• CVE-2026-0291 MEDIUM 4.4 UPGRADE An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access A

FAQ

How do I fix Palo Alto PAN-OS vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Palo Alto PAN-OS being exploited right now?

Yes: 1 Palo Alto PAN-OS CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which Palo Alto PAN-OS CVE should I patch first?

CVE-2026-109618 currently ranks highest (71/100): PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques.

← Back to latest CVEs