[NEW] [high] Palo Alto Networks PAN-OS: Multiple vulnerabilities

highCVE-2026-0279 CVE-2026-0280 CVE-2026-0281 CVE-2026-0282 CVE-2026-0283 CVE-2026-0284

An attacker can exploit multiple vulnerabilities in Palo Alto Networks PAN-OS to perform a Cross-Site Scripting attack, execute arbitrary code, bypass security measures, manipulate data, disclose confidential information, or trigger a Denial-of-Service condition.

CSIRTS triage

vendor: Palo Alto Networks product: PAN-OS Remote code execution Cross-site scripting Authentication bypass Information disclosure Denial of service

What: Multiple vulnerabilities can be exploited to perform Cross-Site Scripting, execute arbitrary code, and cause Denial-of-Service conditions.
Who is affected: Users of Palo Alto Networks PAN-OS are affected.
Urgency: Remediation is urgent due to the high severity and potential for exploitation.
Action: Update to the latest version of PAN-OS.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch PAN-OS

Get an email when a new PAN-OS advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: high
Published: 2026-07-10
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2261

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-02791.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 64% of all scored CVEs.
Low exploitation riskCVE-2026-02800.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all scored CVEs.
Low exploitation riskCVE-2026-02810.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all scored CVEs.
Low exploitation riskCVE-2026-02820.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all scored CVEs.
Low exploitation riskCVE-2026-02830.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
Low exploitation riskCVE-2026-02840.50% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all scored CVEs.
Low exploitation riskCVE-2026-02850.49% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all scored CVEs.
Moderate exploitation riskCVE-2026-02861.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 62% of all scored CVEs.
Low exploitation riskCVE-2026-02870.53% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.
Low exploitation riskCVE-2026-02880.52% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-0279	coverage & exploitation status	NVD · CVE.org
CVE-2026-0280	coverage & exploitation status	NVD · CVE.org
CVE-2026-0281	coverage & exploitation status	NVD · CVE.org
CVE-2026-0282	coverage & exploitation status	NVD · CVE.org
CVE-2026-0283	coverage & exploitation status	NVD · CVE.org
CVE-2026-0284	coverage & exploitation status	NVD · CVE.org
CVE-2026-0285	coverage & exploitation status	NVD · CVE.org
CVE-2026-0286	coverage & exploitation status	NVD · CVE.org
CVE-2026-0287	coverage & exploitation status	NVD · CVE.org
CVE-2026-0288	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for Palo Alto Networks PAN-OS

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-0287: Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unau…nvd · 2026-07-09
unknownCVE-2026-0286: A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® softwar…nvd · 2026-07-09
unknownCVE-2026-0285: A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enable…nvd · 2026-07-09
unknownCVE-2026-0284: An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networ…nvd · 2026-07-09
unknownCVE-2026-0283: An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto N…nvd · 2026-07-09
unknownCVE-2026-0282: A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated…nvd · 2026-07-09