This vulnerability (CVE-2026-0285) in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to perform SSRF attacks, making unauthorized requests from the firewall to internal services. The issue specifically affects PAN-OS and does not impact Panorama, Cloud NGFW, or Prisma Access. The vulnerability has a CVSS 3.1 score of 4.9 (medium severity) with an attack vector of network, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The risk is mitigated by restricting management interface access to trusted internal IP addresses as per Palo Alto Networks' best practice guidelines.

An authenticated administrator with network access to the management web interface can exploit this SSRF vulnerability to make unauthorized requests from the firewall to internal services, potentially impacting the integrity of internal systems. There is no direct confidentiality or availability impact reported. The vulnerability does not affect cloud-based services such as Panorama, Cloud NGFW, or Prisma Access.

No official patch or fix status is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Meanwhile, Palo Alto Networks recommends restricting access to the management interface to trusted internal IP addresses following their best practice deployment guidelines to minimize risk.