Palo Alto Networks Patches Dozens of Flaws
CERT-FR advisory details numerous vulnerabilities across PAN-OS, GlobalProtect, Prisma Access/Browser and Checkov allowing RCE, privilege escalation and DoS; patches available.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 9 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has issued an advisory consolidating multiple vulnerabilities disclosed by Palo Alto Networks on 11 November 2026 affecting a broad range of products: PAN-OS (versions 10.2.x, 11.1.x, 11.2.x, 12.1.x and 12.2.x), GlobalProtect App for Windows (6.2.x and 6.3.x), Prisma Access (10.2.x, 11.2.x, 12.1.x), Prisma Access Browser, and Checkov by Prisma Cloud. The flaws collectively enable remote code execution, privilege escalation, remote denial of service, server-side request forgery (SSRF), security policy bypass, and loss of data confidentiality or integrity. No evidence of active exploitation is mentioned in the advisory; this is a coordinated patch release rather than a report of an ongoing attack.
Palo Alto Networks published nine dedicated security bulletins (CVE-2026-0323 through CVE-2026-0331) alongside a broader advisory (PAN-SA-2026-0014) referencing dozens of additional CVE identifiers covering the same product set. Given the volume of CVEs (over 60 referenced in total), defenders should prioritize patching internet-facing and VPN-exposed components — PAN-OS firewalls, GlobalProtect gateways/clients, and Prisma Access — as these are the most likely targets for exploitation of RCE and privilege escalation issues. Checkov and Prisma Access Browser should also be updated per vendor guidance.
Remediation is to upgrade to the fixed versions specified by Palo Alto Networks: PAN-OS 10.2.18-h14, 11.1.16-h5, 11.2.16-h2, 12.1.10-h4, 12.2.4-h2 or later; GlobalProtect App 6.2.8-h4 (6.2.8-317) and 6.3.3-h3 (6.3.3-711) for Windows; Prisma Access 10.2.10-h43 and 12.1.10-h4 or later; Prisma Access Browser 157.19.4.39 or later; and Checkov 3.4.2 or later. Defenders should consult the individual Palo Alto Networks security bulletins linked in the advisory for per-CVE severity scores and applicability to their deployed product versions.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1521
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs