PatchTheCEVpaloaltonetworks vulnerabilities
Recent CVEs affecting paloaltonetworks products. 14 tracked.
paloaltonetworks has 14 tracked vulnerabilities, 1 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 14. Most recent: 2026-10-21. Highest priority: CVE-2026-109618 (score 71/100).
- CVE-2026-0298 HIGH 8.1 UPGRADE An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of
- CVE-2026-0297 HIGH 8.1 UPGRADE UPGRADE A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-
- CVE-2026-0296 HIGH 7.4 UPGRADE UPGRADE Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthentic
- CVE-2026-0299 HIGH 7.8 UPGRADE UPGRADE Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to
- CVE-2026-0294 HIGH 7.8 UPGRADE A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and ma
- CVE-2026-0289 MEDIUM 6.5 UPGRADE A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enabl
- CVE-2026-0295 HIGH 7.0 UPGRADE A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-
- CVE-2026-0292 MEDIUM 6.0 UPGRADE An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Win
- CVE-2026-0293 MEDIUM 6.0 UPGRADE A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administra
- CVE-2026-0290 MEDIUM 5.5 UPGRADE An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Brows
- CVE-2026-0291 MEDIUM 4.4 UPGRADE An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access A
- CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
- CVE-2026-109619 HIGH 8.1 UPGRADE MITIGATE PHP has various global state that temporarily points into request memory
- CVE-2026-0322 HIGH 7.2 EXPLOITED UPGRADE Palo Alto Networks PAN-OS Code Injection Vulnerability
FAQ
How do I fix paloaltonetworks vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is paloaltonetworks being exploited right now?
Yes: 1 paloaltonetworks CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which paloaltonetworks CVE should I patch first?
CVE-2026-109618 currently ranks highest (71/100): PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques.