SB2026101523 - Multiple vulnerabilities in Palo Alto PAN-OS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101523

SB2026101523 - Multiple vulnerabilities in Palo Alto PAN-OS

Published: October 15, 2026

Security Bulletin ID SB2026101523
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-0321)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper checking for unusual or exceptional conditions in PAN-OS network services when processing network traffic received at or passing through a dataplane interface. A remote attacker can send specially crafted network traffic to or through a dataplane interface to cause a denial of service.

No special configuration is required for exposure.


2) OS Command Injection (CVE-ID: CVE-2026-0320)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary commands as root.

The vulnerability exists due to improper neutralization of special elements used in operating system commands in PAN-OS when an administrator accesses the management interface. A remote privileged user can bypass system restrictions to execute arbitrary commands as root.

No special configuration is required for exposure.


3) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-0319)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to establish a GlobalProtect session using another user's identity.

The vulnerability exists due to improper checks for unusual or exceptional conditions in the GlobalProtect gateway when handling user-supplied input during session establishment. A remote user can manipulate input to establish a GlobalProtect session using another user's identity.

No special configuration is required for exposure.


4) Stack-based buffer overflow (CVE-ID: CVE-2026-0318)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a stack-based buffer overflow in the log processing functionality of PAN-OS on Panorama when processing logs. A remote attacker can trigger the vulnerable log processing functionality over the network to cause a denial of service.

Exposure requires Panorama in panorama system-mode, or management-only mode with a Log Collector, with a Collector Group configured.


5) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-0317)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to cause a denial of service.

The vulnerability exists due to improper checks for unusual or exceptional conditions in the PAN-OS API when processing API requests. A remote privileged user can send a specially crafted API request to cause a denial of service.

A read-only administrator role is sufficient for exploitation. No special configuration is required.


6) Cross-site scripting (CVE-ID: CVE-2026-0316)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote privileged user to execute JavaScript in the web interface.

The vulnerability exists due to improper neutralization of input during web page generation in the PAN-OS web interface when rendering stored content. A remote privileged user can store a JavaScript payload through the web interface to execute JavaScript in the web interface.

Exploitation requires passive user interaction. No special configuration is required for exposure.


Remediation

Install update from vendor's website.

References