Product of Palo Alto Networks

PAN-OS

As of , 12 Palo Alto Networks PAN-OS vulnerabilities are on CISA's list of exploited vulnerabilities, 6 of them used in ransomware campaigns; 2 were added in 2026. Patch first: CVE-2026-0257.

Patch first

Patch first
#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2026-0257Authentication BypassPalo Alto Networks PAN-OSPatch nowRansomware use, listed within a year0.97
2CVE-2017-15944Remote Code ExecutionPalo Alto Networks PAN-OSPatch this weekMetasploit module; EPSS 0.98; verified Exploit-DB entry0.98
3CVE-2024-0012Management Interface Authentication BypassPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
4CVE-2024-9474Management Interface OS Command InjectionPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.950.95
5CVE-2024-3400Command InjectionPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
6CVE-2025-0108Authentication BypassPalo Alto Networks PAN-OSPatch this weekEPSS 0.980.98
7CVE-2019-1579Remote Code ExecutionPalo Alto Networks PAN-OSPatch this weekRansomware use0.46
8CVE-2020-2021Authentication BypassPalo Alto Networks PAN-OSPatch this weekRansomware use0.04
9CVE-2026-0300Out-of-bounds WritePalo Alto Networks PAN-OSPatch soon0.32
10CVE-2024-3393Malicious DNS PacketPalo Alto Networks PAN-OSPatch soon0.29
11CVE-2022-0028Reflected Amplification Denial-of-ServicePalo Alto Networks PAN-OSPatch soon0.03
12CVE-2025-0111File ReadPalo Alto Networks PAN-OSPatch soon0.02

Added each year

12342022: 4420222023: nonenone20232024: 4420242025: 2220252026: 222026
Entries CISA added each year, removed ones included. Source: CISA KEV.
Show the numbers
Periodentries added
20224
2023none
20244
20252
20262

Used in ransomware

Changes CISA made to these entries

  1. CVE-2026-0257 Palo Alto Networks PAN-OSRansomware use: Unknown to Known.
  2. CVE-2026-0300 Palo Alto Networks PAN-OSEdited: required action.
  3. CVE-2024-9474 Palo Alto Networks PAN-OSRansomware use: Unknown to Known.
  4. CVE-2024-0012 Palo Alto Networks PAN-OSRansomware use: Unknown to Known.
  5. CVE-2024-3400 Palo Alto Networks PAN-OSRansomware use: Unknown to Known.
  6. CVE-2025-0108 Palo Alto Networks PAN-OSRenamed from Palo Alto to Palo Alto Networks. Edited: description and name.
  7. CVE-2025-0108 Palo Alto Networks PAN-OSDeadline moved from 8 April 2025 to 11 March 2025.

Every change we recorded