VendorsEdge, Security
Palo Alto Networks
Palo Alto Networks makes PAN-OS next-generation firewalls, the GlobalProtect VPN, Panorama management, Prisma Access and the Cortex security products.
- Response trend, 6 months
- Not enough history
- Open now
- None
- Latest incident
- 14 Oct 2026
- Incidents on record
- 8
Response to exploited bugs
80 range 69–91rank 8 of 10
Provisional 3 reviewed zero-days. Not enough yet for a firm grade.
Fixing privately reported bugs
Not rated. No private reports in the grading window.
What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work
Why these grades
Every clock starts at the first public report.
- Response to exploited bugs: B (80), provisional, from 3 reviewed zero-days in the last 36 months. Likely range 69 to 91.
- First fix within a day for 1 of 3 zero-days. The other 2 took a median of 9 days, longest 10 days.
- Every supported version fixed within a day for 0 of 3 zero-days. The other 3 took a median of 10 days, longest 23 days.
- First advisory within a day for all 3 zero-days. Its advisory said the bug was being exploited in 3 of 3.
- Fixing privately reported bugs: not rated. No private reports in the last 36 months.
- 5 of 8 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade. For 3 of them, fixes for every version came later, up to 15 days.
Response to exploited bugs: sub-scores
- Time to first advisory3 of 3 zero-days within a day83B+3 cases, low confidence, weight 20%
- Time to first fix1 of 3 zero-days within a day, longest 10 days77B3 cases, low confidence, weight 40%
- Time to fix all versions0 of 3 zero-days within a day, longest 23 days79B3 cases, low confidence, weight 30%
- OpennessAdvisories published as CSAF. 3 of 3 zero-days with a dated revision history. 3 of 3 advisories said the bug was exploited. 3 of 3 fixed zero-days with a public fix date for every version. 2 of 2 zero-days not fixed within a day had an advisory or mitigation within 72 hours.89A−10 cases, medium confidence, weight 10%
Fixing privately reported bugs: sub-score
- Private fix speedNo private reports in the last 36 monthsNR0 cases, not used
Response fingerprint
Median of 3 graded zero-days. Vendor statement 0h, first fix 7.7d, all versions 10d.
Counts toward the response grade 3
- 14 Oct 2026PAN-OS management interface authenticated remote code execution
- 5 May 2026PAN-OS User-ID Authentication Portal unauthenticated buffer overflow (zero-day)
- 8 Nov 2024PAN-OS management interface auth bypass chained with privilege escalation (Operation Lunar Peek)
Not graded 5: n-days, unreviewed timelines and end-of-life products
- 13 May 2026PAN-OS GlobalProtect authentication override cookie bypassNot graded: n-day
- 12 Feb 2025PAN-OS management web interface authentication bypass, chained with file read and CVE-2024-9474Not graded: n-day
- 27 Dec 2024PAN-OS DNS Security denial of service from a crafted packet (exploited)Not graded: n-day
- 9 Oct 2024Expedition OS command injection and SQL injection exposing firewall credentials (PAN-SA-2024-0010)Not graded: n-day
- 10 Jul 2024Expedition missing authentication allowing admin account takeoverNot graded: n-day
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Open, no fix
- Open, partly fixed
- Fixed when disclosed
- Date only, no time of day
One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.
Exploited incidents
8 in 24 months, 3 with known ransomware use, 38% exploited before a fix
Private reports
None in the window
Bugs reported privately to Palo Alto Networks by ZDI or Project Zero.
No privately reported cases from ZDI or Project Zero in the window.
Advisories changed after publication
14 shown, 0 without a revision noteRecorded in the revision history Palo Alto Networks Security Advisories /
Version table: 2 rows added and 2 rows removed. One new row reads "PAN-OS 11.2 | = 11.2.0-h1 >= 11.2.1-h1 >= 11.2.2-h2 >= 11.2.3-h3 >= 11.2.4-h1".
- Fixed versions
- Version table rows
- BeforePAN-OS 11.2 | = 11.2.1-h1 >= 11.2.2-h2 >= 11.2.3-h3 >= 11.2.4-h1; PAN-OS 10.2 | = 10.2.0-h4 >= 10.2.1-h3 >= 10.2.2-h6 >= 10.2.3-h14 >= 10.2.4-h32 >= 10.2.5-h9 >= 10.2.6-h6 >= 10.2.7-h18 >= 10.2.8-h15 >= 10.2.9-h16 >= 10.2.10-h9 >= 10.2.11-h6 >= 10.2.12-h2 >= 10.2.12-h2
- AfterPAN-OS 11.2 | = 11.2.0-h1 >= 11.2.1-h1 >= 11.2.2-h2 >= 11.2.3-h3 >= 11.2.4-h1; PAN-OS 10.2 | = 10.2.0-h4 >= 10.2.1-h3 >= 10.2.2-h6 >= 10.2.3-h14 >= 10.2.4-h32 >= 10.2.5-h9 >= 10.2.6-h6 >= 10.2.7-h18 >= 10.2.8-h15 >= 10.2.9-h16 >= 10.2.10-h9 >= 10.2.11-h6 >= 10.2.12-h2
Recorded in the revision history Palo Alto Networks Security Advisories /
CVSS base vector changed from AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L to AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N. Published date changed from 2024-11-08 to 2024-11-18.
- Severity
- Dates
- CVSS vector
- BeforeAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- AfterAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N
- Published date
- Before2024-11-08
- After2024-11-18
Verbatim wording. Removed text is struck through. Added text is bold. Beforeur scan did not find any devices with internet-facingmanagement interfacefor your account. Severity:CRITICALCVSSv4.0 Base Score:9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:A/AU:Y/R:U/V:C/RE:M/U:Red)Exploitation Status Palo Alto Networks has observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited numberofAfterighest when you allow access to the management interface from external IP addresses on the internet. CRITICAL - CVSS-BT: 9.3 / CVSS-B: 9.3 ( CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:A/AU:N/R:U/V:C/RE:H/U:Red ) If you configure restricted access to a jump box that is the only system allowed to access the management interface, you greatly reduce the risk of exploitation beca
Show 12 more changes
Recorded in the revision history PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
CVSS exploit maturity changed from unreported to attacked (displayed score 4.7 to 7.8). Advisory now says the bug is exploited (earlier version: vendor not aware). Version table: 4 rows added and 4 rows removed. One new row reads "PAN-OS 12.1 | = 12.1.4-h6 >= 12.1.7".
- Severity
- Exploitation status
- Fixed versions
- CVSS exploit maturity
- Beforeunreported
- Afterattacked
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
- Version table rows
- BeforePAN-OS 12.1 | = 12.1.4-h6 (ETA: 05/18) >= 12.1.7 (ETA: 05/28); PAN-OS 11.2 | = 11.2.4-h17 (ETA: 05/28) >= 11.2.7-h14 (ETA: 05/14) >= 11.2.10-h7 (ETA: 05/14) >= 11.2.12 (ETA: 05/28); PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15 (ETA: 05/28
- AfterPAN-OS 12.1 | = 12.1.4-h6 >= 12.1.7; PAN-OS 11.2 | = 11.2.4-h17 >= 11.2.7-h14 >= 11.2.10-h7 >= 11.2.12; PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15; PAN-OS 10.2 | = 10.2.7-h34 >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.2.18-h6
Recorded in the revision history PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
Version table: 1 row added and 1 row removed. One new row reads "PAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.".
- Fixed versions
- Version table rows
- BeforePAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21 (ETA: 05/28) >= 10.2.16-h7 (ETA: 05/28) >= 10.2.18-h6
- AfterPAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.2.18-h6
Verbatim wording. Removed text is struck through. Added text is bold. Before10-h6 >= 11.2.12 (ETA: 05/28) PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15 (ETA: 05/28) PAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21
(ETA: 05/28)>= 10.2.16-h7(ETA: 05/28)>= 10.2.18-h6 Prisma Access | None | All Required Configuration for Exposure This issue is applicable only to PA-Series and VM-SeriesfirewaAfter10-h6 >= 11.2.12 (ETA: 05/28) PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15 (ETA: 05/28) PAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/28) >= 10.2.10-h36 >= 10.2.13-h21 >= 10.2.16-h7 >= 10.2.18-h6 Prisma Access | None | All Required Configuration for Exposure This issue is applicable only to PA-Series and VM-Series firewalls that are configured to
Recorded in the revision history PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal
Version table: 21 rows added and 4 rows removed. One new row reads "PAN-OS 12.1 | = 12.1.4-h5 >= 12.1.7 (ETA: 05/28)".
- Fixed versions
- Version table rows
- BeforePAN-OS 12.1 | = 12.1.4-h5 (ETA: 05/13) >= 12.1.7 (ETA: 05/28); PAN-OS 11.2 | = 11.2.4-h17 (ETA: 05/28) >= 11.2.7-h13 (ETA: 05/13) >= 11.2.10-h6 (ETA: 05/13) >= 11.2.12 (ETA: 05/28); PAN-OS 11.1 | = 11.1.4-h33 (ETA: 05/13) >= 11.1.6-h32 (ETA: 05/13) >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 (ETA: 05/1
- AfterPAN-OS 12.1 | = 12.1.4-h5 >= 12.1.7 (ETA: 05/28); PAN-OS 11.2 | = 11.2.4-h17 (ETA: 05/28) >= 11.2.7-h13 >= 11.2.10-h6 >= 11.2.12 (ETA: 05/28); PAN-OS 11.1 | = 11.1.4-h33 >= 11.1.6-h32 >= 11.1.7-h6 (ETA: 05/28) >= 11.1.10-h25 >= 11.1.13-h5 >= 11.1.15 (ETA: 05/28); PAN-OS 10.2 | = 10.2.7-h34 (ETA: 05/
Recorded in the revision history PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
Version table: 9 rows added and 4 rows removed. One new row reads "PAN-OS 11.2 | = 11.2.4-h4 >= 11.2.5".
- Fixed versions
- Version table rows
- BeforePAN-OS 11.2 | = 11.2.4-h4; PAN-OS 11.1 | = 11.1.6-h1; PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3; PAN-OS 11.2 | 11.2.0 through 11.2.4 | Upgrade to 11.2.4-h4 or later
- AfterPAN-OS 11.2 | = 11.2.4-h4 >= 11.2.5; PAN-OS 11.1 | = 11.1.2-h18 >= 11.1.4-h13 >= 11.1.6-h1; PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.10-h14 >= 10.2.11-h12 >= 10.2.12-h6 >= 10.2.13-h3; 10.2.10 | Upgrade to 10.2.10-h14 or 10.2.13-h3 or later
Recorded in the revision history PAN-OS: Authentication Bypass in the Management Web Interface
Version table: 5 rows added and 2 rows removed. One new row reads "PAN-OS 11.1 | = 11.1.2-h18 >= 11.1.6-h1".
- Fixed versions
- Version table rows
- BeforePAN-OS 11.1 | = 11.1.6-h1; PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3
- AfterPAN-OS 11.1 | = 11.1.2-h18 >= 11.1.6-h1; PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.10-h14 >= 10.2.11-h12 >= 10.2.12-h6 >= 10.2.13-h3; 10.2.10 | Upgrade to 10.2.10-h14 or 10.2.13-h3 or later; 10.2.11 | Upgrade to 10.2.11-h12 or 10.2.13-h3 or later
Recorded in the revision history PAN-OS: Authenticated File Read Vulnerability in the Management Web Interface
CVSS exploit maturity changed from unreported to attacked (displayed score 4.9 to 7.1). Advisory now says the bug is exploited (earlier version: vendor not aware). Version table: 5 rows added and 1 row removed. One new row reads "PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3".
- Severity
- Exploitation status
- Fixed versions
- CVSS exploit maturity
- Beforeunreported
- Afterattacked
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
- Version table rows
- BeforePAN-OS 10.2 | = 10.2.13-h3
- AfterPAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3; 10.2.7 | Upgrade to 10.2.7-h24 or 10.2.13-h3 or later; 10.2.8 | Upgrade to 10.2.8-h21 or 10.2.13-h3 or later; 10.2.9 | Upgrade to 10.2.9-h21 or 10.2.13-h3 or later
Recorded in the revision history PAN-OS: Authentication Bypass in the Management Web Interface
CVSS exploit maturity changed from proof of concept to attacked (displayed score 7.8 to 8.8). Advisory now says the bug is exploited (earlier version: vendor not aware). Version table: 5 rows added and 1 row removed. One new row reads "PAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3".
- Severity
- Exploitation status
- Fixed versions
- CVSS exploit maturity
- Beforeproof of concept
- Afterattacked
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
- Version table rows
- BeforePAN-OS 10.2 | = 10.2.13-h3
- AfterPAN-OS 10.2 | = 10.2.7-h24 >= 10.2.8-h21 >= 10.2.9-h21 >= 10.2.12-h6 >= 10.2.13-h3; 10.2.7 | Upgrade to 10.2.7-h24 or 10.2.13-h3 or later; 10.2.8 | Upgrade to 10.2.8-h21 or 10.2.13-h3 or later; 10.2.9 | Upgrade to 10.2.9-h21 or 10.2.13-h3 or later
Recorded in the revision history Palo Alto Networks Security Advisories /
Version table: 1 row added and 1 row removed. One new row reads "PAN-OS 11.1 | = 11.1.2-h16 >= 11.1.3-h13 >= 11.1.4-h7 >= 11.1.5".
- Fixed versions
- Version table rows
- BeforePAN-OS 11.1 | = 11.1.2-h16 >= 11.1.3-h13 >= 11.1.4-h6 >= 11.1.5
- AfterPAN-OS 11.1 | = 11.1.2-h16 >= 11.1.3-h13 >= 11.1.4-h7 >= 11.1.5
Verbatim wording. Removed text is struck through. Added text is bold. Beforema Access. Product Status Versions | Affected | Unaffected Cloud NGFW | None | All PAN-OS | None on Panorama | All on Panorama PAN-OS 11.2 | = 11.2.3 PAN-OS 11.1 | = 11.1.2-h16 >= 11.1.3-h13 >=
11.1.4-h6>= 11.1.5 PAN-OS 10.2 | >= 10.2.8 = 10.2.8-h19 >= 10.2.9-h19 >= 10.2.10-h12 >= 10.2.11-h10 >= 10.2.12-h4 >= 10.2.13-h2 >= 10.2.14 PAN-OS 10.1 | >= 10.1.14 = 10.1.14-h8 >= 10.1.15 PAN-OS 10.0 | NonAfterma Access. Product Status Versions | Affected | Unaffected Cloud NGFW | None | All PAN-OS | None on Panorama | All on Panorama PAN-OS 11.2 | = 11.2.3 PAN-OS 11.1 | = 11.1.2-h16 >= 11.1.3-h13 >= 11.1.4-h7 >= 11.1.5 PAN-OS 10.2 | >= 10.2.8 = 10.2.8-h19 >= 10.2.9-h19 >= 10.2.10-h12 >= 10.2.11-h10 >= 10.2.12-h4 >= 10.2.13-h2 >= 10.2.14 PAN-OS 10.1 | >= 10.1.14 = 10.1.14-h8 >= 10.1.15 PAN-OS 10.0 | Non
Recorded in the revision history Palo Alto Networks Security Advisories /
Workaround text changed.
- Workaround
- Workaround
- BeforeIf your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama Within Objects → Security Profil
- AfterIf your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama Ensure that a DNS Security Confi
Recorded in the revision history Palo Alto Networks Security Advisories /
Workaround text changed.
- Workaround
- Workaround
- BeforeIf your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama For each Anti-spyware profile, n
- AfterIf your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment. Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama Within Objects → Security Profil
Recorded in the revision history Expedition: Multiple Vulnerabilities in Expedition Lead to Exposure of Firewall Credentials
Advisory now says the bug is exploited (earlier version: vendor not aware).
- Exploitation status
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
Recorded in the revision history Expedition: Missing Authentication Leads to Admin Account Takeover
Advisory now says the bug is exploited (earlier version: vendor not aware).
- Exploitation status
- Exploitation status
- Beforevendor not aware of exploitation
- Aftervendor aware of exploitation
Grade history
Response to exploited bugs: score at the end of each month.
Show as a table
| Month | Score | Grade |
|---|---|---|
| Nov 2025 | – | NR |
| Dec 2025 | – | NR |
| Jan 2026 | – | NR |
| Feb 2026 | – | NR |
| Mar 2026 | – | NR |
| Apr 2026 | – | NR |
| May 2026 | – | NR |
| Jun 2026 | – | NR |
| Jul 2026 | – | NR |
| Aug 2026 | – | NR |
| Sep 2026 | – | NR |
| Oct 2026 | 80 | B |
Channels
Get Palo Alto Networks's own alerts
- EmailPalo Alto Networks advisory email subscriptionSign up for the vendor’s security notification emails.
- RSSPalo Alto Networks security advisories RSSAdd the advisory feed to a feed reader or chat integration.
- CSAFPalo Alto Networks per-advisory CSAFPoint a CSAF-aware tool at the provider metadata.
- APIPalo Alto Networks advisory CSV exportPoll the advisory API from your own tooling.
- BlueskyPalo Alto Networks on BlueskyFollow the account.
- XPalo Alto Networks on XFollow the account and turn on notifications.
- Advisory pagePalo Alto Networks security advisories indexCheck the advisory page. It has no push channel.
What we watch
- RSSPalo Alto Networks security advisories RSS
- BlueskyPalo Alto Networks on Bluesky
See sources and health for when each was last read.
Grade B.