# Palo Alto Networks products patched for multiple RCE and privilege escalation flaws

Published: 2026-06-11 · Severity: elevated · Sectors: defense, government-national, healthcare, financial-services, energy, technology
Canonical: https://vorant.io/reports/eec06852-3005-5305-b171-583d3f3f043d/palo-alto-networks-products-patched-for-multiple-rce-and-privilege-escalation

> CERT-FR advisory covers multiple critical vulnerabilities in PAN-OS, GlobalProtect, Cortex XSOAR and other Palo Alto products enabling remote code execution and privilege escalation.

CERT-FR has published a security advisory covering multiple vulnerabilities affecting Palo Alto Networks products released June 10, 2026. The vulnerabilities span PAN-OS versions 10.2.x through 12.1.x, GlobalProtect App versions 6.2.x and 6.3.x, Cortex XSOAR and XSIAM, Prisma Access Agent, and Prisma Browser. The flaws enable remote code execution, privilege escalation, denial of service, confidentiality breaches, security policy bypass, and cross-site scripting. Defenders operating any of these products should review Palo Alto Networks' official security bulletins for patched versions and apply updates urgently. The advisory references over 40 CVEs with numbered bulletin links for each affected component.

## Mentioned in this report

- Vulnerabilities: CVE-2026-0266, CVE-2026-0267, CVE-2026-0268, CVE-2026-0269, CVE-2026-0270, CVE-2026-0271, CVE-2026-0272, CVE-2026-0273, CVE-2026-0274, CVE-2026-8509, CVE-2026-8510, CVE-2026-8511, CVE-2026-8512, CVE-2026-8513, CVE-2026-8514, CVE-2026-8515, CVE-2026-8516, CVE-2026-8517, CVE-2026-8518, CVE-2026-8519, CVE-2026-9110, CVE-2026-9111, CVE-2026-9112, CVE-2026-9113, CVE-2026-9114, CVE-2026-9115, CVE-2026-9116, CVE-2026-9117, CVE-2026-9118, CVE-2026-9120, CVE-2026-9121, CVE-2026-9123, CVE-2026-9124, CVE-2026-9126, CVE-2026-9872, CVE-2026-9873, CVE-2026-9874, CVE-2026-9875, CVE-2026-9876, CVE-2026-9877

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0734

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/eec06852-3005-5305-b171-583d3f3f043d/palo-alto-networks-products-patched-for-multiple-rce-and-privilege-escalation.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup