# CERT-FR Flags Palo Alto PAN-OS RCE Flaw

Published: 2026-10-27 · Severity: elevated · Sectors: Technology
Canonical: https://vorant.io/reports/23af097a-d7af-56b8-8075-14acef31edb3/cert-fr-flags-palo-alto-pan-os-rce-flaw
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advises a PAN-OS and Prisma Cloud vulnerability allows remote code execution, DoS, and data confidentiality breaches.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1396

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: A public exploit is recorded for CVE-2026-111497 (templated); no exploitation in the wild is recorded.

CERT-FR issued an advisory regarding a vulnerability (CVE-2026-111497) affecting multiple Palo Alto Networks products, including PAN-OS versions 11.2.x prior to 11.2.10-h17, 12.1.x prior to 12.1.7-h11, and 12.2.x prior to 12.2.4-h1, as well as Prisma Cloud Application Security Transporter Client versions prior to 0.2.9. The flaw permits an attacker to achieve remote arbitrary code execution, remote denial of service, and compromise of data confidentiality and integrity.

Patches for several additional PAN-OS branches (12.1.4-h13, 12.1.10-h3, 11.2.4-h23, 11.2.7-h23, 11.2.13-h4, and 11.2.16-h1) are pending release at the time of this advisory. Defenders running affected PAN-OS or Prisma Cloud Transporter Client versions should monitor Palo Alto Networks' official security bulletin for CVE-2026-111497 and apply fixes as soon as they become available for their specific branch. No in-the-wild exploitation is mentioned in the advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2026-111497 (templated)

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1396

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/23af097a-d7af-56b8-8075-14acef31edb3/cert-fr-flags-palo-alto-pan-os-rce-flaw.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup