Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI and the device...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 12.2.0 through 12.2.2 Upgrade to 12.2.3 or later. PAN-OS 12.1 12.1.8 through 12.1.9 Upgrade to 12.1.10 or later. 12.1.5 through 12.1.7-...
A vulnerability in the EndPoint Data Loss Prevention (DLP) enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data. This Prisma Access Agent on macOS, Linux, iOS, Android and...
Fixed versionsPrisma Access Agent 0 >= 26.2 on Windows, Prisma Access Agent All on Linux, All on macOS, All on iOS, All on Android, All on ChromeOS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Prisma Access Agent on Windows 24.0 through 26.2 Upgrade to 26.2 or later. Prisma Access Agent on Linux No action needed. Prisma Access Agent on macOS No action needed. Prisma ...
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM.
Affected productsCortex XDR Broker VM, Cortex XDR Broker VM 20.0.96
Fixed versionsCortex XDR Broker VM 20.0.96 >= 32.0.52
Vendor guidance
This issue is fixed in Cortex XDR Broker VM 32.0.52, and all later Cortex XDR Broker VM versions. * If automatic upgrades are enabled for Broker VM, then no action is required at this time. * If automatic upgrades are...
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series fir...
Fixed versionsCloud NGFW All, PAN-OS 12.2 All, PAN-OS 12.1 >= 12.1.10, PAN-OS 11.2 >= 11.2.13-h2
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 No action needed. PAN-OS 12.1 12.1.2 through 12.1.9 Upgrade to 12.1.10 or later. PAN-OS 11.2 11.2.0 through 11.2.13 Upgrade to 11.2.13-...
An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credentials. The Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected.
Fixed versionsPrisma Access Agent 24.0 >= 26.3 on Linux, Prisma Access Agent All on macOS, All on Windows, All on iOS, All on Android, All on ChromeOS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Prisma Access Agent on Linux 25.7 through 26.2.2 Upgrade to 26.3 or later. Prisma Access Agent on macOS No action needed. Prisma Access Agent on Windows No action needed. Prism...
A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.
Affected productsCheckov by Prisma Cloud, Checkov by Prisma Cloud 3.2.0
Fixed versionsCheckov by Prisma Cloud 3.2.0 >= 3.2.532
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Checkov by Prisma Cloud 3.2 3.2.0 through 3.2.531 Upgrade to 3.2.532or later. Checkov integration in Prisma Cloud is upgraded automatically when new versions become available.
An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov.
Affected productsCheckov by Prisma Cloud, Checkov by Prisma Cloud 3.2.0
Fixed versionsCheckov by Prisma Cloud 3.2.0 >= 3.2.502
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Checkov by Prisma Cloud 3.2 3.2.0 through 3.2.501 Upgrade to 3.2.502 or later.
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allow a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands ...
Fixed versionsGlobalProtect App 6.3 >= 6.3.3-h11 (6.3.3-c1016) on Windows, >= 6.3.3-h11 (6.3.3-c1016) on macOS, >= 6.3.3-h2 (6.3.3-c42) on Linux, GlobalProtect App 6.2 >= 6.2.8-h10 (6.2.8-948) on Windows, >= 6.2.8-h10 (6.2.8-948) on macOS, GlobalProtect App 6.0 >= 6.0.13 on Windows, >= 6.0.13 on macOS, >= 6.0.11 on Linux, GlobalProtect App All on Android, All on ChromeOS, All on iOS, All on UWP
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.0 on Windows 6.0.0 through 6.0.12 Upgrade to 6.0.13 or later. GlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h9 Upgrade to 6.2.8-h10 (6.2.8-948) or la...
Palo Alto Networks incorporated the following Chromium security fixes into our products: * https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html
A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Andro...
Fixed versionsPrisma Access Agent 0 >= 26.3 on Windows (ETA: 08/20), Prisma Access Agent All on Linux, All on macOS, All on iOS, All on Android, All on Chrome OS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Prisma Access Agent on Windows 24.0 through 26.2.2 Upgrade to 26.3 or later. Prisma Access Agent on macOS No action needed. Prisma Access Agent on Linux No action needed. Prism...
A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected.
Fixed versionsPrisma Access Agent 0 >= 26.3 on Windows (ETA: 08/20), >= 26.3 on macOS (ETA: 08/20), Prisma Access Agent All on Linux, All on iOS, All on Android, All on Chrome OS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Prisma Access Agent on Windows 24.0 through 26.2.2 Upgrade to 26.3 or later. Prisma Access Agent on macOS 24.0 through 26.2.2 Upgrade to 26.3 or later. Prisma Access Agent on L...
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on ...
Fixed versionsPrisma Access Agent 0 >= 26.2.2 on Linux, Prisma Access Agent All on macOS, All on Windows, All on iOS, All on Android, All on Chrome OS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Prisma Access Agent on Linux 25.7 through 26.2.1 Upgrade to 26.2.2 or later. Prisma Access Agent on macOS No action needed. Prisma Access Agent on Windows No action needed. Pri...
An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administrator to bypass security inspection, subsequently allowing them to inject and intercept arbitrary network traffic. The Prisma Access Agent...
Fixed versionsPrisma Access Agent 0 >= 26.3 on Windows (ETA: 08/20), Prisma Access Agent All on Linux, All on macOS, All on iOS, All on Android, All on Chrome OS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Prisma Access Agent on Windows 24.0 through 26.2.2 Upgrade to 26.3 or later. Prisma Access Agent on Linux No action needed. Prisma Access Agent on macOS No action needed. Prism...
An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability.
Fixed versionsCloud NGFW None on AWS*, None on Azure*, PAN-OS 12.1 All, PAN-OS 11.2 All, PAN-OS 11.1 >= 11.1.16-h1
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW* Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. PAN-OS 12.1 12.1.2 through 12.1.6-h* No action n...
Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, GlobalProtect™ gateway/portal features and Clientless VPN of Palo Alto Networks PAN-OS® software enables a malicious unauthenticated user to store or execute malic...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.1 12.1.2 through 12.1.7-h* Upgrade to 12.1.8 or later. PAN-OS 11.2 11.2.0 through 11.2.12 Upgrade to 11.2.13 or later. PAN-OS 11.1 11.1.0...
Palo Alto Networks incorporated the following Chromium security fixes into our products: * https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html
Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sendi...
Fixed versionsCloud NGFW All on AWS, All on Azure unless you have been contacted by Palo Alto Networks, PAN-OS 12.1 >= 12.1.4-h8, >= 12.1.7-h2, >= 12.1.8, PAN-OS 11.2 >= 11.2.4-h20, >= 11.2.7-h18, >= 11.2.10-h12, >= 11.2.13, PAN-OS 11.1 >= 11.1.4-h35, >= 11.1.6-h35, >= 11.1.7-h8, >= 11.1.10-h30, >= 11.1.13-h9, >= 11.1.16
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later. PAN...
Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attem...
VERSION MINOR VERSION RANGE SUGGESTED SOLUTION Cloud NGFW Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrad...
A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services. The security risk posed by ...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later. PAN...
An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal L...
VERSION MINOR VERSION RANGE SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or late...
An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection. Panorama, Cloud NGFW, and Pr...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW All No action needed. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later....
A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access is restricted to a...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW All No action needed. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later....
Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected.
Fixed versionsPrisma Access Agent 0 >= 26.2.1 on Windows, Prisma Access Agent All on macOS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Prisma Access Agent on Windows 24.0 through 26.2 Upgrade to 26.2.1 or later. Prisma Access Agent on macOS No action needed.
An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services. Cloud NGFW and Panor...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.1 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h2 or 12.1.8 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h8 or 12.1.8 or later. PAN...
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.