This vulnerability (CWE-918) in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface of Cloud NGFW to perform SSRF attacks. This allows the attacker to make unauthorized requests from the firewall to internal services, potentially bypassing network restrictions. The vulnerability is mitigated by restricting management interface access to trusted internal IP addresses as per Palo Alto Networks' best practice guidelines. Other Palo Alto Networks products such as Panorama, Cloud NGFW, and Prisma Access are not affected. No patch or official remediation level has been disclosed at this time.

An authenticated administrator with network access to the management web interface can exploit this SSRF vulnerability to send unauthorized requests from the firewall to internal services. This could lead to unauthorized internal network interactions. The overall risk is considered medium severity (CVSS 4.7) and is reduced if management interface access is properly restricted.

No official patch or remediation has been announced yet. The vendor recommends restricting management interface access to trusted internal IP addresses to minimize risk. Monitor the vendor advisory for updates on patch availability and apply recommended access controls as a temporary mitigation.