CVE Vulnerability Advisory Database

[Affected Scope] Management interfaces of PA-Series, VM-Series firewalls, and Panorama (Virtual and M-Series) running PAN-OS

[Impact] An authenticated attacker with network access can execute arbitrary code with root privileges, leading to full system compromise

[Mitigation] Apply the latest security patches immediately and restrict management interface access to trusted internal IP addresses only

[Affected Scope] Palo Alto Networks PAN-OS software with GlobalProtect portal or gateway enabled (Panorama and Cloud NGFW are not impacted).

[Impact] Unauthenticated attackers can bypass security restrictions to establish unauthorized VPN connections and gain access to internal network resources.

[Mitigation] Apply the official security patches immediately, and restrict access to GlobalProtect interfaces until fully patched.

[Affected Scope] Palo Alto Networks PAN-OS software running on PA-Series and VM-Series firewalls with the User-ID™ Authentication Portal (Captive Portal) service enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary code with root privileges on the firewall by sending specially crafted packets.

[Mitigation] Apply the latest security patches immediately, and restrict access to the User-ID™ Authentication Portal to trusted internal IP addresses only.

[Affected Scope] PAN-OS firewalls with the management web interface enabled and accessible via the network (excluding Cloud NGFW and Prisma Access)

[Impact] Authenticated attackers can read sensitive system files on the PAN-OS filesystem that are readable by the 'nobody' user, potentially exposing configuration details

[Mitigation] Apply the latest PAN-OS security patches immediately and restrict management interface access to trusted internal IP addresses

[Affected Scope] Palo Alto Networks PAN-OS software management web interface (excluding Cloud NGFW and Prisma Access)

[Impact] Unauthenticated remote attackers with network access can bypass authentication on the management interface and invoke sensitive PHP scripts, severely compromising system integrity and confidentiality

[Mitigation] Immediately upgrade to the patched PAN-OS versions and restrict access to the management interface to trusted internal IP addresses only

[Affected Scope] Palo Alto Networks PAN-OS software versions with the DNS Security feature enabled

[Impact] An unauthenticated remote attacker can send malicious packets through the data plane, causing the firewall to reboot. Repeated exploitation forces the device into maintenance mode, leading to a complete network outage

[Mitigation] Immediately upgrade PAN-OS to the patched versions recommended by the vendor, and review DNS Security profile configurations as a temporary measure

[Affected Scope] Authenticated administrators with access to the PAN-OS management web interface

[Impact] Complete system compromise via arbitrary OS command execution with root privileges on the firewall

[Mitigation] Apply official security patches immediately and restrict access to the management interface from the public internet

[Affected Scope] Palo Alto Networks firewall appliances running PAN-OS 10.2, 11.0, 11.1, and 11.2 with the management web interface exposed to the network.

[Impact] Unauthenticated remote attackers can bypass authentication to gain administrative privileges, modify configurations, or chain with other privilege escalation flaws like CVE-2024-9474 to compromise the system.

[Mitigation] Immediately upgrade to the patched PAN-OS versions and restrict management interface access to trusted internal IP addresses only.

[Affected Scope] Palo Alto Networks Expedition migration tool versions prior to 1.2.96

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands as root, leading to the exposure of PAN-OS firewall usernames, cleartext passwords, device configurations, and API keys

[Mitigation] Immediately upgrade Expedition to version 1.2.96 or later, and rotate all potentially exposed firewall credentials and API keys

[Affected Scope] Palo Alto Networks PAN-OS 10.2, 11.0, and 11.1 firewalls with GlobalProtect gateway or portal enabled

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with root privileges on the firewall via specially crafted requests

[Mitigation] Immediately apply the official PAN-OS hotfix, or implement temporary workarounds such as disabling Device Telemetry or applying Threat Prevention signatures

[Affected Scope] Palo Alto Networks PAN-OS firewalls (PA-Series, VM-Series, CN-Series) configured with a URL filtering profile containing blocked categories assigned to a source zone with an external-facing interface.

[Impact] Remote attackers can abuse the firewall as a reflector and amplifier to launch high-volume TCP Reflected Denial-of-Service (RDoS) attacks against arbitrary targets, masking their identity.

[Mitigation] Apply official PAN-OS software updates immediately, or review and remove URL filtering profiles from security policies applied to external-facing source zones.

[Affected Scope] PAN-OS 8.1, 9.0, and 9.1 versions, Panorama, and GlobalProtect gateways with SAML authentication enabled and 'Validate Identity Provider Certificate' disabled

[Impact] Unauthenticated remote attackers can bypass SAML signature verification to gain administrative access to PAN-OS/Panorama web interfaces or access protected network resources

[Mitigation] Upgrade PAN-OS to patched versions (9.1.3, 9.0.9, 8.1.15 or later) or enable the 'Validate Identity Provider Certificate' option in the SAML Identity Provider Server Profile

[Affected Scope] PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or Gateway enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary code with root privileges on the target firewall, leading to complete system compromise.

[Mitigation] Immediately upgrade PAN-OS to patched versions (7.1.19, 8.0.12, 8.1.3, or later) and restrict access to GlobalProtect interfaces.

[Affected Scope] PAN-OS versions before 6.1.19, 7.0.19, 7.1.14, and 8.0.6 management interface

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with root privileges via the management interface, leading to complete device compromise

[Mitigation] Immediately upgrade to the patched versions and restrict access to the management interface from the public internet