Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 421

Export CSV
CVE-2025-0136

PAN-OS: Unencrypted Data Transfer when using AES-128-CCM on Intel-based hardware devices

Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Series) leads to unencrypted data transfer to devices that are connected to the PAN-OS firewall through IPSec. This issue does not affect Cloud NGFWs, Prisma® Access instances, or PAN-OS VM-Series firewalls. NOTE: The AES-128-CCM encryption algorithm is not recommended for use.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Pan-os
CVE-2025-0127

PAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-Series

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. This issue is only applicable to PAN-OS VM-Series. This issue does not affect firewalls that are already deployed. Cloud NGFW and Prisma® Access are not affected by this vulnerability.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Pan-os
CVE-2025-0112

Cortex XDR Agent: Local Windows User Can Disable the Agent

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This vulnerability can also be leveraged by malware to disable the Cortex XDR agent and then perform malicious activity.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Cortex Xdr Agent
CVE-2025-0134

Cortex XDR Broker VM: Authenticated Code Injection Vulnerability in Broker VM

A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating system running Broker VM.

CVSS 4.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Cortex Xdr Broker Vm
CVE-2025-4618

Prisma Browser: Sensitive Information Disclosure Vulnerability in Prisma Browser

A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to retrieve sensitive data from Prisma Browser. Browser self-protection should be enabled to mitigate this issue.

CVSS 4.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Palo Alto Networks Paloaltonetworks
Products
Prisma Browser Prisma Browser
CVE-2025-0128

PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet

A denial-of-service (DoS) vulnerability in the Simple Certificate Enrollment Protocol (SCEP) authentication feature of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. Cloud NGFW is not affected by this vulnerability. Prisma® Access software is proactively patched and protected from this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Pan-os
CVE-2025-0132

Cortex XDR Broker VM: Unauthenticated User Can Disable Internal Services

A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM.  The attacker must have network access to the Broker VM to exploit this issue.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Cortex Xdr Broker Vm
CVE-2025-0137

PAN-OS: Improper Neutralization of Input in the Management Web Interface

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Pan-os
CVE-2025-0138

Prisma Cloud Compute Edition: Insufficient Session Expiration Vulnerability in the Web Interface

Web sessions in the web interface of Palo Alto Networks Prisma® Cloud Compute Edition do not expire when users are deleted, which makes Prisma Cloud Compute Edition susceptible to unauthorized access. Compute in Prisma Cloud Enterprise Edition is not affected by this issue.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Prisma Cloud Compute Edition
CVE-2025-0123

PAN-OS: Information Disclosure Vulnerability in HTTP/2 Packet Captures

A vulnerability in the Palo Alto Networks PAN-OS® software enables unlicensed administrators to view clear-text data captured using the packet capture feature https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/take-packet-captures/take-a-custom-packet-capture in decrypted HTTP/2 data streams traversing network interfaces on the firewall. HTTP/1.1 data streams are not impacted. In normal conditions, decrypted packet captures are available to firewall administrators after they obtain and install a free Decryption Port Mirror license. The license requirement ensures that this feature can only be used after approved personnel purposefully activate the license. For more information, review how to configure decryption port mirroring https://docs.paloaltonetworks.com/network-security/decryption/administration/monitoring-decryption/configure-decryption-port-mirroring . The administrator must obtain network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. Risk of this issue can be greatly reduced by restricting access to the management interface to only trusted administrators and from only internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Customer firewall administrators do not have access to the packet capture feature in Cloud NGFW. This feature is available only to authorized Palo Alto Networks personnel permitted to perform troubleshooting. Prisma® Access is not impacted by this vulnerability.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Pan-os
CVE-2025-0116

PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted LLDP Frame

A Denial of Service (DoS) vulnerability in Palo Alto Networks PAN-OS software causes the firewall to unexpectedly reboot when processing a specially crafted LLDP frame sent by an unauthenticated adjacent attacker. Repeated attempts to initiate this condition causes the firewall to enter maintenance mode. This issue does not apply to Cloud NGFWs or Prisma Access software.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Pan-os
CVE-2025-4616

Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser

An insufficient validation of an untrusted input vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to revert the browser’s security controls.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Prisma Browser
CVE-2025-4235

User-ID Credential Agent: Cleartext Exposure of Service Account password

An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the service account password under specific non-default configurations. This allows an unprivileged Domain User to escalate privileges by exploiting the account’s permissions. The impact varies by configuration: * Minimally Privileged Accounts: Enable disruption of User-ID Credential Agent operations (e.g., uninstalling or disabling the agent service), weakening network security policies that leverage Credential Phishing Prevention https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention under a Domain Credential Filter https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/credential-phishing-prevention/methods-to-check-for-corporate-credential-submissions configuration. * Elevated Accounts (Server Operator, Domain Join, Legacy Features): Permit increased impacts, including server control (e.g., shutdown/restart), domain manipulation (e.g., rogue computer objects), and network compromise via reconnaissance or client probing.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft Palo Alto Paloaltonetworks
Products
Windows Networks User-id Credential Agent
CVE-2025-2184

Cortex XDR Broker VM: Secrets Shared Across Multiple Broker VM Images

A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations. The attacker must have network access to the Broker VM to exploit this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Cortex Xdr Broker Vm
CVE-2025-0121

Cortex XDR Agent: Local Windows User Can Crash the Agent

A null pointer dereference vulnerability in the Palo Alto Networks Cortex® XDR agent on Windows devices allows a low-privileged local Windows user to crash the agent. Additionally, malware can use this vulnerability to perform malicious activity without Cortex XDR being able to detect it.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Cortex Xdr Agent
CVE-2025-4617

Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browser

An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the screenshot control feature of the browser. Browser self-protection should be enabled to mitigate this issue.

CVSS 4.0 · 1.1 Low EPSS < 1% KEV · Not listed
Vendors
Microsoft Paloaltonetworks
Products
Windows Prisma Browser
CVE-2025-2180

Checkov by Prisma Cloud: Unsafe Deserialization of Terraform Files Allows Code Execution

An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma® Cloud. This issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Checkov
CVE-2025-0115

PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLI

A vulnerability in the Palo Alto Networks PAN-OS software enables an authenticated admin on the PAN-OS CLI to read arbitrary files. The attacker must have network access to the management interface (web, SSH, console, or telnet) and successfully authenticate to exploit this issue. You can greatly reduce the risk of this issue by restricting access to the management interface to only trusted users and internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW or Prisma Access.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Pan-os
CVE-2025-0117

GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

A reliance on untrusted input for a security decision in the GlobalProtect app on Windows devices potentially enables a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY\SYSTEM. GlobalProtect App on macOS, Linux, iOS, Android, Chrome OS and GlobalProtect UWP App are not affected.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Globalprotect App
CVE-2025-0125

PAN-OS: Improper Neutralization of Input in the Management Web Interface

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW and all Prisma® Access instances.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Paloaltonetworks
Products
Pan-os