Vulnerabilidades em Palo Alto Networks

364 resultados
Análise Vexday

Das 316 CVEs catalogadas para Palo Alto Networks, 13 estão confirmadas em exploração ativa no catálogo KEV da CISA, representando uma taxa 9,1 vezes acima da média geral do catálogo — sinal de que vulnerabilidades nesse vendor atraem exploração real com frequência desproporcional. A CVE mais crítica em atividade é a CVE-2024-3400, que atingiu EPSS máximo de 1,0, indicando probabilidade extremamente elevada de exploração observada ou iminente. O tipo de falha mais recorrente é CWE-78 (injeção de comandos no sistema operacional), uma classe de vulnerabilidade com alto potencial de impacto em appliances de segurança de perímetro. Com 17 CVEs críticas, 15 com PoC pública e 39 surgidas nos últimos 90 dias, equipes responsáveis por ambientes que utilizam produtos Palo Alto Networks devem priorizar ciclos curtos de patching e monitorar ativamente os indicadores de exploração.

CVE-2020-2043LOWPAN-OS: Passwords may be logged in clear text when using after-change-detail custom syslog field for config logsEPSS 0.7%CVE-2020-2044LOWPAN-OS: Passwords may be logged in clear text while storing operational command (op command) historyEPSS 0.7%CVE-2022-0023MEDIUMPAN-OS: Denial-of-Service (DoS) Vulnerability in DNS ProxyEPSS 0.7%CVE-2021-3062HIGHPAN-OS: Improper Access Control Vulnerability Exposing AWS Instance Metadata Endpoint to GlobalProtect UsersEPSS 0.7%CVE-2024-9467HIGHExpedition: Reflected Cross-Site Scripting Vulnerability Leads to Expedition Session DisclosureEPSS 0.7%CVE-2019-1565—The PAN-OS external dynamics lists in PAN-OS 7.1.21 and earlier, PAN-OS 8.0.14 and earlier, and PAN-OS 8.1.5 and earlier, may allow an attacEPSS 0.7%CVE-2026-0310HIGHPAN-OS: Buffer Overflow Vulnerability via XML ProcessingEPSS 0.7%CVE-2022-0011MEDIUMPAN-OS: URL Category Exceptions Match More URLs Than Intended in URL FilteringEPSS 0.7%CVE-2023-6790HIGHPAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web InterfaceEPSS 0.7%CVE-2026-0298MEDIUMGlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)EPSS 0.7%CVE-2020-2013HIGHPAN-OS: Panorama context switch session cookie disclosureEPSS 0.7%CVE-2021-3043HIGHPrisma Cloud: Cross-Site Scripting (XSS) Vulnerability in Prisma Cloud Compute Web ConsoleEPSS 0.6%CVE-2021-3052HIGHPAN-OS: Reflected Cross-Site Scripting (XSS) in Web InterfaceEPSS 0.6%CVE-2020-1980HIGHPAN-OS: Shell injection vulnerability in PAN-OS CLI allows execution of shell commandsEPSS 0.6%CVE-2025-0109MEDIUMPAN-OS: Unauthenticated File Deletion Vulnerability on the Management Web InterfaceEPSS 0.6%CVE-2023-6791MEDIUMPAN-OS: Plaintext Disclosure of External System Integration CredentialsEPSS 0.6%CVE-2025-4230HIGHPAN-OS: Authenticated Admin Command Injection Vulnerability Through CLIEPSS 0.6%CVE-2019-1574—Cross-site scripting (XSS) vulnerability in Palo Alto Networks Expedition Migration tool 1.1.12 and earlier may allow an authenticated attacEPSS 0.6%CVE-2026-0287MEDIUMPAN-OS: Denial of Service Vulnerabilities in Network Traffic ProcessingEPSS 0.6%CVE-2025-0103CRITICALExpedition: SQL Injection VulnerabilityEPSS 0.6%