Threat database

CVE-2026-0270 is a path traversal vulnerability in Palo Alto Networks Cortex XSOAR version 8.13 running on Linux. It allows an unauthenticated attacker on an adjacent network who can perform a man-in-the-middle attack to write arbitrary files to the host system. The vulnerability has a CVSS score of 4.8, indicating medium severity. No patch or official remediation has been confirmed yet.

A memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.

CVE-2026-0267 is an information exposure vulnerability in the Palo Alto Networks GlobalProtect app for macOS. It allows a local user to discover the configured passcodes used to disable, disconnect, or uninstall the app. With knowledge of these passcodes, the user can bypass normal configuration restrictions and perform these actions. The vulnerability affects versions 6.2.0 and 6.3.0 of the GlobalProtect app. The CVSS score is 4.4, indicating a medium severity level. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

A cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not affected by this vulnerability.

A denial of service (DoS) vulnerability in Palo Alto Networks Prisma SD-WAN ION devices enables an unauthenticated attacker in a network adjacent to a Prisma SD-WAN ION device to cause a system disruption by sending a specially crafted IPv6 packet.

An improper certificate validation vulnerability in the Prisma Access Agent® for Android and Chrome OS enables an attacker to perform a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information. The Prisma Access Agent on macOS, Windows, Linux and iOS are not affected.

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform.

An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.

Incorrect Authorization vulnerabilities in Trust Protection Foundation allow attackers to bypass access controls and perform unauthorized actions on restricted resources.

Multiple information disclosure vulnerabilities in Prisma Access Agent® allow a local user to access sensitive configuration data and credentials. The Prisma Access Agent on Linux, ChromeOS, Android, and iOS are not affected.

An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.

A vulnerability with a privilege management mechanism in the Palo Alto Networks Prisma Access Agent® enables a locally authenticated non-administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. This allows the user to execute arbitrary code and read sensitive information otherwise accessible only to privileged accounts. The Prisma Access Agent on iOS, Android and Chrome OS are not affected.

Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execute privileged operations.

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enables an attacker to intercept encrypted communications and potentially compromise the endpoint. This can enable a local non-administrative operating system user or an attacker on the same subnet to redirect traffic to an unauthorized server and facilitate the installation of malicious software. The GlobalProtect app on Linux, Windows, iOS and GlobalProtect UWP app are not affected.

CVE-2026-0239 is an information disclosure vulnerability in Palo Alto Networks Chronosphere Chronocollector. It allows an unauthenticated attacker with network access to the collector service to retrieve sensitive information. The vulnerability is categorized under CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. The CVSS 4.0 base score is 4.9, reflecting a medium severity level. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

CVE-2026-0250 is a medium severity buffer overflow vulnerability in the Palo Alto Networks GlobalProtect app versions 6.2.0 and 6.3.0 (excluding iOS). It allows a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges during the processing of Portal and Gateway communications. There is no known exploit in the wild and no official patch or remediation guidance currently available.

CVE-2026-0238 is a low-severity vulnerability in Palo Alto Networks Broker VM version 30.0 that allows an authenticated administrator to inject arbitrary content into certain Broker VM fields due to improper input validation. The vulnerability requires local access with low privileges and does not involve user interaction. There are no known exploits in the wild, and no official patch or remediation guidance has been provided yet. The impact is limited to potential unauthorized content injection by an authenticated administrator. No geographic targeting is indicated.

CVE-2026-0251 is a local privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app versions 6.0.0, 6.2.0, and 6.3.0 on Windows, macOS, and Linux. It allows a local non-administrative user to escalate privileges to SYSTEM on Windows or root on macOS and Linux by exploiting an untrusted search path issue. Mobile and UWP versions of the app are not affected. The vulnerability has a CVSS 4.

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store a JavaScript payload using the web interface. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.