Palo Alto Networks patches multiple PAN-OS flaws
CERT-FR advisory details multiple vulnerabilities in Palo Alto Networks PAN-OS, GlobalProtect, Prisma and Cortex products enabling RCE, DoS, XSS and privilege escalation.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 28 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR has published an advisory (CERTFR-2026-AVI-1156) summarizing a batch of vulnerabilities disclosed by Palo Alto Networks on 09 September 2026 across a wide range of products, including PAN-OS (multiple hotfix branches from 10.2 through 12.2), GlobalProtect App (Android, ChromeOS, iOS and Windows/Linux clients), Prisma Access, Prisma Access Agent, Prisma Browser, Cloud NGFW, Cortex XDR Broker, and Checkov by Prisma Cloud. The vulnerabilities collectively allow an attacker to achieve remote arbitrary code execution, remote denial of service, indirect remote code injection (XSS), and privilege escalation; some issues are unspecified by the vendor pending further detail. No public exploitation has been confirmed in this advisory.
The advisory references numerous CVE identifiers (CVE-2026-0302 through CVE-2026-0310, plus a further set of CVE-2026-76xxx, 79xxx and 84xxx entries) tied to individual Palo Alto Networks security bulletins and a PAN-SA advisory. Given the breadth of affected products — spanning core firewall OS, VPN/endpoint agents, cloud access, and Cortex components — organizations running Palo Alto Networks infrastructure should treat this as a priority patch cycle, particularly for internet-facing PAN-OS and GlobalProtect deployments where RCE and DoS vectors carry the highest operational risk.
Defenders should identify all affected product versions in their estate (PAN-OS hotfix branches, GlobalProtect client versions, Prisma Access/Agent/Browser versions, Cortex XDR Broker, Cloud NGFW, and Checkov) and apply the vendor-supplied patches referenced in the official Palo Alto Networks security bulletins. Until patched, apply standard hardening (restrict management interface exposure, monitor for anomalous traffic/crashes on PAN-OS and GlobalProtect services) as compensating controls.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1156
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs