Threat Intelligence Database

CVE-2026-0319 is a medium severity vulnerability in Palo Alto Networks PAN-OS GlobalProtect gateway that allows an authenticated user to establish a GlobalProtect session using another user's identity. This improper input handling flaw does not affect Cloud NGFW or Panorama products. Multiple PAN-OS versions prior to specific fixed releases are affected.

CVE-2026-0320 is a command injection vulnerability in Palo Alto Networks PAN-OS software that allows an authenticated administrator to execute arbitrary commands as root. Exploitation requires access to the PAN-OS management interface. The vulnerability affects PA-Series and VM-Series firewalls and Panorama (virtual and M-Series), but not Cloud NGFW or Prisma Access. Restricting management interface access to trusted internal IP addresses significantly reduces risk. The vulnerability has a medium severity with a CVSS 4.0 score of 6.1.

A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall. The security risk posed by this issue is minimized by restricting access to the management interface to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.