Vendor

Palo Alto Networks

As of , 15 Palo Alto Networks vulnerabilities are on CISA's list of exploited vulnerabilities, 6 of them used in ransomware campaigns; 2 were added in 2026. Patch first: CVE-2026-0257.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2026-0257Authentication BypassPalo Alto Networks PAN-OSPatch nowRansomware use, listed within a year0.97
2CVE-2017-15944Remote Code ExecutionPalo Alto Networks PAN-OSPatch this weekMetasploit module; EPSS 0.98; verified Exploit-DB entry0.98
3CVE-2024-0012Management Interface Authentication BypassPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
4CVE-2024-9474Management Interface OS Command InjectionPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.950.95
5CVE-2024-5910Missing AuthenticationPalo Alto Networks ExpeditionPatch this weekMetasploit module; EPSS 0.920.92
6CVE-2024-3400Command InjectionPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
7CVE-2025-0108Authentication BypassPalo Alto Networks PAN-OSPatch this weekEPSS 0.980.98
8CVE-2024-9463OS Command InjectionPalo Alto Networks ExpeditionPatch this weekEPSS 0.990.99
9CVE-2024-9465SQL InjectionPalo Alto Networks ExpeditionPatch this weekEPSS 0.990.99
10CVE-2019-1579Remote Code ExecutionPalo Alto Networks PAN-OSPatch this weekRansomware use0.46
11CVE-2020-2021Authentication BypassPalo Alto Networks PAN-OSPatch this weekRansomware use0.04
12CVE-2026-0300Out-of-bounds WritePalo Alto Networks PAN-OSPatch soon0.32
13CVE-2024-3393Malicious DNS PacketPalo Alto Networks PAN-OSPatch soon0.29
14CVE-2022-0028Reflected Amplification Denial-of-ServicePalo Alto Networks PAN-OSPatch soon0.03
15CVE-2025-0111File ReadPalo Alto Networks PAN-OSPatch soon0.02

Products

Added each year

24682022: 4420222023: nonenone20232024: 7720242025: 2220252026: 222026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20224
2023none
20247
20252
20262

Used in ransomware

Changes CISA made to these entries

  1. CVE-2026-0257 Palo Alto Networks PAN-OSRansomware use: Unknown to Known.
  2. CVE-2026-0300 Palo Alto Networks PAN-OSEdited: required action.
  3. CVE-2024-9474 Palo Alto Networks PAN-OSRansomware use: Unknown to Known.
  4. CVE-2024-0012 Palo Alto Networks PAN-OSRansomware use: Unknown to Known.
  5. CVE-2024-3400 Palo Alto Networks PAN-OSRansomware use: Unknown to Known.
  6. CVE-2025-0108 Palo Alto Networks PAN-OSRenamed from Palo Alto to Palo Alto Networks. Edited: description and name.
  7. CVE-2025-0108 Palo Alto Networks PAN-OSDeadline moved from 8 April 2025 to 11 March 2025.

Every change we recorded