58.476 CVE seguite
793 Sfruttate ora
188 Usate dai ransomware
Ultima sincronia
Vulnerabilità Palo Alto
383 CVE
| Identificativo | Gravità, ordinato dal più alto | Prodotto e difetto | EPSS, ordina dal più alto | In KEV dal, ordina dal più alto |
|---|---|---|---|---|
| CVE-2024-3400 | CRIT 10.0 | ransomware paloaltonetworks pan-os A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbit | 100,0% | |
| CVE-2020-2021 | CRIT 10.0 | ransomware paloaltonetworks pan-os When Security Assertion Markup Language (SAML) authentication is enabled and the 'Validate Identity Provider Certificate' option is disabled (unchecked), improper verification of signatures in PAN-OS SAML authentication enables an unauthenticated network-based | 4,4% | |
| CVE-2019-17440 | CRIT 10.0 | paloaltonetworks pan-os Improper restriction of communications to Log Forwarding Card (LFC) on PA-7000 Series devices with second-generation Switch Management Card (SMC) may allow an attacker with network access to the LFC to gain root access to PAN-OS. This issue affects PAN-OS 9.0 | 1,7% | — |
| CVE-2012-6603 | HIGH 10.0 | paloaltonetworks pan-os The web management UI in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to bypass authentication and obtain administrator privileges via unspecified vectors, aka Ref ID 37034. | 4,4% | — |
| CVE-2012-6601 | HIGH 10.0 | paloaltonetworks pan-os The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x before 4.1.4 allows remote attackers to execute arbitrary code via unspecified vectors, aka Ref ID 36983. | 4,4% | — |
| CVE-2012-6593 | HIGH 10.0 | paloaltonetworks pan-os Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.4 allows remote attackers to execute arbitrary commands via unspecified vectors, aka Ref ID 30088. | 4,1% | — |
| CVE-2012-6592 | HIGH 10.0 | paloaltonetworks pan-os Palo Alto Networks PAN-OS before 3.1.10 and 4.0.x before 4.0.5 allows remote attackers to execute arbitrary commands via unspecified vectors, aka Ref ID 31091. | 4,1% | — |
| CVE-2026-0284 | CRIT 9.9 | paloaltonetworks pan-os An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corrupt | 0,5% | — |
| CVE-2026-0300 | CRIT 9.8 | paloaltonetworks pan-os A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls | 31,7% | |
| CVE-2026-0264 | CRIT 9.8 | paloaltonetworks pan-os A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all PAN-OS platforms except Cloud NGFW and Pris | 0,5% | — |
| CVE-2026-0263 | CRIT 9.8 | paloaltonetworks pan-os A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition. | 0,4% | — |
| CVE-2025-0107 | CRIT 9.8 | paloaltonetworks expedition An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations | 78,5% | — |
| CVE-2024-5914 | CRIT 9.8 | paloaltonetworks cortex_xsoar_commonscripts A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the context of an integration container. | 1,2% | — |
| CVE-2024-5910 | CRIT 9.8 | paloaltonetworks expedition Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichm | 91,8% | |
| CVE-2024-0012 | CRIT 9.8 | ransomware paloaltonetworks pan-os An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or | 99,8% | |
| CVE-2021-3064 | CRIT 9.8 | paloaltonetworks pan-os A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attac | 20,1% | — |
| CVE-2021-3044 | CRIT 9.8 | paloaltonetworks cortex_xsoar An improper authorization vulnerability in Palo Alto Networks Cortex XSOAR enables a remote unauthenticated attacker with network access to the Cortex XSOAR server to perform unauthorized actions through the REST API. This issue impacts: Cortex XSOAR 6.1.0 bui | 1,4% | — |
| CVE-2020-2040 | CRIT 9.8 | paloaltonetworks pan-os A buffer overflow vulnerability in PAN-OS allows an unauthenticated attacker to disrupt system processes and potentially execute arbitrary code with root privileges by sending a malicious request to the Captive Portal or Multi-Factor Authentication interface. | 3,9% | — |
| CVE-2019-1581 | CRIT 9.8 | paloaltonetworks pan-os A remote code execution vulnerability in the PAN-OS SSH device management interface that can lead to unauthenticated remote users with network access to the SSH management interface gaining root access to PAN-OS. This issue affects PAN-OS 7.1 versions prior to | 3,2% | — |
| CVE-2019-1580 | CRIT 9.8 | paloaltonetworks pan-os Memory corruption in PAN-OS 7.1.24 and earlier, PAN-OS 8.0.19 and earlier, PAN-OS 8.1.9 and earlier, and PAN-OS 9.0.3 and earlier will allow a remote, unauthenticated user to craft a message to Secure Shell Daemon (SSHD) and corrupt arbitrary memory. | 3,2% | — |
| CVE-2018-10143 | CRIT 9.8 | paloaltonetworks expedition The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on the device hosting this service/application. | 24,8% | — |
| CVE-2017-9458 | CRIT 9.8 | paloaltonetworks pan-os XML external entity (XXE) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to obtain sensitive inform | 2,5% | — |
| CVE-2017-8390 | CRIT 9.8 | paloaltonetworks pan-os The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 allows remote attackers to execute arbitrary code via a crafted domain name. | 6,1% | — |
| CVE-2017-7945 | CRIT 9.8 | paloaltonetworks pan-os The GlobalProtect external interface in Palo Alto Networks PAN-OS before 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for failed login attempts depending on whether the username exists, which allows remo | 1,8% | — |
| CVE-2017-15944 | CRIT 9.8 | paloaltonetworks pan-os Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote attackers to execute arbitrary code via vectors involving the management interface. | 98,3% |