Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.
Palo Alto Networks is aware of the vulnerability in Brotli: CVE-2026-111497. A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decod...
PAN-OS This issue will be fixed in the upcoming releases of PAN-OS. Refer Product Status table for details. Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below...
Palo Alto Networks is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control...
Fixed versionsBridgecrew All, Cloud NGFW All, Cortex Cloud All, Cortex XDR Agent All
Vendor guidance
PAN-OS This issue will be fixed in the upcoming releases of PAN-OS. This advisory will be updated with fixed versions and release estimates as they become available. Until PAN-OS fix versions are available we recommen...
Multiple local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app allows a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands...
Fixed versionsGlobalProtect App 6.3 >= 6.3.3-h15 (6.3.3-c63) on Linux, >= 6.3.3-h16 (6.3.3-1199) on macOS, >= 6.3.3-h16 (6.3.3-1199) on Windows, GlobalProtect App 6.0 >= 6.0.15 on Linux (ETA: 10/29), >= 6.0.15 on macOS (ETA: 10/29), >= 6.0.15 on Windows (ETA: 10/29), GlobalProtect App 6.2 >= 6.2.8-h15 (6.2.8-1084) on macOS, >= 6.2.8-h15 (6.2.8-1084) on Windows, GlobalProtect App All on iOS, All on Android, All on ChromeOS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.2/6.3 on Linux 6.2.0 through 6.3.3-h14 Upgrade to 6.3.3-h15 (6.3.3-c63) or later. GlobalProtect App 6.0 on Linux 6.0.0 through 6.0.14 Upgrade to 6.0.15 or l...
A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimiz...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 12.2.0 through 12.2.3 Upgrade to 12.2.4 or later. PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h2 or later. 12.1.5 through ...
Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to tr...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 12.2.0 through 12.2.3 Upgrade to 12.2.4 or later. PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h2 or later. 12.1.5 through ...
A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS management interfa...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 12.2.0 through 12.2.3 Upgrade to 12.2.4 or later. PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h2 or later. 12.1.5 through ...
A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request. The security risk posed by this issue is significa...
VERSION MINOR VERSION RANGE SUGGESTED SOLUTION Cloud NGFW No action required. PAN-OS 12.1 12.2.0 through 12.2.3-h* Upgrade to 12.2.4 or later. PAN-OS 12.1 12.1.2 through 12.1.10-h* Upgrade to 12.1.10-h2 or later. PAN-...
Palo Alto Networks incorporated the following Chromium security fixes into our products: * https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html
A local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect™ app enables a local user to escalate their privileges to root on macOS. This enables a non-administrative user to execute arbitrary commands with administrative privileges. The GlobalProtect ap...
Fixed versionsGlobalProtect App 6.2 >= 6.2.8-h15 (6.2.8-1084) on macOS, GlobalProtect App 6.3 >= 6.3.3-h16 (6.3.3-1199) on macOS, GlobalProtect App All on Linux, All on Windows, All on iOS, All on Android, All on ChromeOS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h15 Upgrade to 6.3.3-h16 (6.3.3-1199) or later. GlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h14 Upgrade to 6.2.8-h15 (...
A command injection vulnerability in Palo Alto Networks Cortex XSOAR and Cortex XSIAM OS Query content pack enables an authenticated administrator to execute arbitrary OS commands on remote endpoints.
Affected productsCortex XSOAR OS Query, Cortex XSIAM OS Query, Cortex XSOAR OS Query 0, Cortex XSIAM OS Query 0
Fixed versionsCortex XSOAR OS Query 0 >= 1.0.17, Cortex XSIAM OS Query 0 >= 1.0.17
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Cortex XSOAR OS Query Update to 1.0.17 or later from the Cortex XSOAR Marketplace. Cortex XSIAM OS Query Update to 1.0.17 or later from the Cortex XSOAR Marketplace.
A stack-based buffer overflow vulnerability in the log processing functionality of Palo Alto Networks PAN-OS® software on Panorama enables an attacker to cause a denial of service (DoS) condition. Repeated attempts to trigger this condition result in the Panorama entering main...
Fixed versionsCloud NGFW All, PAN-OS 12.2 >= 12.2.4 on Panorama, PAN-OS 12.1 >= 12.1.4-h12 on Panorama, >= 12.1.7-h8 on Panorama, >= 12.1.10-h2 on Panorama, PAN-OS 11.2 >= 11.2.4-h22 on Panorama, >= 11.2.7-h21 on Panorama, >= 11.2.10-h15 on Panorama, >= 11.2.13-h3 on Panorama, >= 11.2.15 on Panorama
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 12.2.0 through 12.2.3 Upgrade to 12.2.4 or later. PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h2 or later. 12.1.5 through ...
An improper input handling vulnerability in the GlobalProtect™ gateway of Palo Alto Networks PAN-OS software enables an authenticated user to establish a GlobalProtect session using the identity of another user. Cloud NGFW and Panorama are not affected by this vulnerability.
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 12.2.0 through 12.2.3 Upgrade to 12.2.4 or later. PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h2 or later. 12.1.5 through ...
A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management int...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 12.2.0 through 12.2.3 Upgrade to 12.2.4 or later. PAN-OS 12.1 12.1.2 through 12.1.10-h* Upgrade to 12.1.10-h2 or later. PAN-OS 11.2 11....
A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denial of service (DoS) condition. The GlobalProtect™ app on Linux, macOS, iOS, Android, and Chrome OS is not affected by this vulnerability.
Fixed versionsGlobalProtect App 6.3 >= 6.3.3-h16 (6.3.3-1199) on Windows, GlobalProtect App 6.2 >= 6.2.8-h15 (6.2.8-1084) on Windows, GlobalProtect App 6.0 >= 6.0.15 on Windows, GlobalProtect App All on Linux, All on macOS, All on iOS, All on Android, All on Chrome OS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h15 Upgrade to 6.3.3-h16 (6.3.3-1199) or later. GlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h14 Upgrade to 6.2.8-h...
Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem.
Affected productsCheckov by Prisma Cloud, Checkov by Prisma Cloud 0
Fixed versionsCheckov by Prisma Cloud 0 >= 3.3.25
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Checkov by Prisma Cloud 3.3 3.2.0 through 3.3.24 Upgrade to 3.3.25 or later. Checkov integration in Prisma Cloud is upgraded automatically when new versions become available.
A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.
Affected productsCheckov by Prisma Cloud, Checkov by Prisma Cloud 0
Fixed versionsCheckov by Prisma Cloud 0 >= 3.2.533
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION Checkov by Prisma Cloud 3.2.0 through 3.2.532 Upgrade to 3.2.533 or later. Checkov integration in Prisma Cloud is upgraded automatically when new versions become available.
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man in the middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This vulnerability is triggered during the processing of req...
Fixed versionsGlobalProtect App 6.3 >= 6.3.3-h9 on Windows, >= 6.3.3-h9 on macOS, >= 6.3.5 on Android, >= 6.3.5 on ChromeOS, >= 6.3.3-h15 on Linux (ETA: 10/06), GlobalProtect App 6.2 >= 6.2.8-h10 on Windows, >= 6.2.8-h10 on macOS, GlobalProtect App 6.1 >= 6.1.14 on Android, >= 6.1.14 on ChromeOS, GlobalProtect App 6.0 >= 6.0.15 on Linux (ETA: 10/29), >= 6.0.13 on Windows, >= 6.0.13 on macOS, >= 6.0.15 on Android (ETA: 10/29), >= 6.0.15 on ChromeOS (ETA: 10/29)
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h8 Upgrade to 6.3.3-h9 (6.3.3-999) or later. GlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h9 Upgrade to 6.2.8-h10 (...
Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with ad...
Fixed versionsGlobalProtect App 6.3 >= 6.3.3-h15 on Linux (ETA: 09/17), >= 6.3.3-h14 (6.3.3-1121) on macOS, >= 6.3.3-h14 (6.3.3-1121) on Windows, GlobalProtect App 6.2 None on Linux, >= 6.2.8-h13 (6.2.8-1045) on macOS, >= 6.2.8-h13 (6.2.8-1045) on Windows, GlobalProtect App 6.0 >= 6.0.15 on Linux (ETA: 10/29), >= 6.0.15 on macOS (ETA: 10/29), >= 6.0.15 on Windows (ETA: 10/29), GlobalProtect App All on iOS, All on Android, All on Chrome OS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3/6.2 on Linux 6.2.0 through 6.3.3-h14 Upgrade to 6.3.3-h15 or later. GlobalProtect App 6.0 on Linux 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later. Global...
An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle (MitM) attacker to execute arbitrary code with SYSTEM privileges on an ...
Fixed versionsGlobalProtect App 6.3 >= 6.3.3-h14 (6.3.3-1121) on Windows, GlobalProtect App 6.2 >= 6.2.8-h13 (6.2.8-1045) on Windows, GlobalProtect App 6.0 >= 6.0.15 on Windows (ETA: 10/29), GlobalProtect App All on Linux, All on macOS, All on Android, All on Chrome OS, All on iOS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3 on Windows 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later. GlobalProtect App 6.2 on Windows 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h...
Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and modify application communications. VPN tunnel traffic is not impacted. The GlobalProtect app on iOS...
Fixed versionsGlobalProtect App 6.3 >= 6.3.3-h15 on Linux (ETA: 09/17), >= 6.3.3-h14 (6.3.3-1121) on macOS, >= 6.3.3-h14 (6.3.3-1121) on Windows, GlobalProtect App 6.2 None on Linux, >= 6.2.8-h13 (6.2.8-1045) on macOS, >= 6.2.8-h13 (6.2.8-1045) on Windows, GlobalProtect App 6.0 >= 6.0.15 on Linux (ETA: 10/29), >= 6.0.15 on macOS (ETA: 10/29), >= 6.0.15 on Windows (ETA: 10/29), GlobalProtect App All on iOS, All on Android, All on Chrome OS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3/6.2 on Linux 6.2.0 through 6.3.3-h14 Upgrade to 6.3.3-h15 or later. GlobalProtect App 6.0 on Linux 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later. Global...
A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-privileged attacker to escalate their privileges to root. The GlobalProtect app on Linux, Windows, iOS, Android, and Chrome OS is not affected.
Fixed versionsGlobalProtect App 6.3 >= 6.3.3-h14 (6.3.3-1121) on macOS, GlobalProtect App 6.2 >= 6.2.8-h13 (6.2.8-1045) on macOS, GlobalProtect App 6.0 >= 6.0.15 on macOS (ETA: 10/29), GlobalProtect App All on Linux, All on Windows, All on iOS, All on Android, All on Chrome OS
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3 on macOS 6.3.0 through 6.3.3-h13 Upgrade to 6.3.3-h14 (6.3.3-1121) or later. GlobalProtect App 6.2 on macOS 6.2.0 through 6.2.8-h12 Upgrade to 6.2.8-h13 (...
A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, an...
Fixed versionsGlobalProtect App 6.3 >= 6.3.3-h15 on Linux (ETA: 09/17), >= 6.3.3-h14 on macOS, >= 6.3.3-h14 on Windows, >= 6.3.5 on iOS, >= 6.3.5 on Android, >= 6.3.5 on Chrome OS, GlobalProtect App 6.2 None on Linux, >= 6.2.8-h13 on macOS, >= 6.2.8-h13 on Windows, GlobalProtect App 6.0 >= 6.0.15 on Linux (ETA: 10/29), >= 6.0.15 on macOS (ETA: 10/29), >= 6.0.15 on Windows (ETA: 10/29), >= 6.0.15 on iOS (ETA: 10/29), >= 6.0.15 on Android (ETA: 1
Vendor guidance
VERSION MINOR VERSION SUGGESTED SOLUTION GlobalProtect App 6.3/6.2 on Linux 6.2.0 through 6.3.3-h14 Upgrade to 6.3.3-h15 or later. GlobalProtect App 6.0 on Linux 6.0.0 through 6.0.14 Upgrade to 6.0.15 or later. Global...
Palo Alto Networks incorporated the following Chromium security fixes into our products: * https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html
A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls o...
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. PAN-OS 12.2 12.2.0 through 12.2.2 Upgrade to 12.2...
We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.
Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.