CISA KEV + NVD
Palo Alto Networks flaws exploited in the wild
13 Palo Alto Networks vulnerabilities CISA lists as used by attackers, each with when it was published, NVD’s severity score, how many days passed between NVD publication and CISA’s KEV listing, and the vendor’s advisory where CISA links one. Catalog version 2026.10.20.
In numbers
- 13 exploited flaws, listed from 10 Jan 2022 to 14 Oct 2026
- 6 used in ransomware campaigns
- 7 scored critical by NVD
- 6 days: median gap between NVD publication and the KEV listing; 7 were listed within a week
All exploited Palo Alto Networks flaws, newest first
| Vulnerability | Product | Published | Added to KEV | CVSS | Advisory |
|---|---|---|---|---|---|
| CVE-2026-0322Palo Alto Networks PAN-OS Code Injection Vulnerability | PAN-OS | 14 Oct 2026 | 14 Oct 2026same day or before NVD | 7.2 High | Vendor |
| CVE-2026-0257Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | PAN-OS | 13 May 2026 | 29 May 202616 days laterUsed in ransomware | 9.1 Critical | Vendor |
| CVE-2026-0300Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability | PAN-OS | 6 May 2026 | 6 May 2026same day or before NVD | 9.8 Critical | Vendor |
| CVE-2025-0111Palo Alto Networks PAN-OS File Read Vulnerability | PAN-OS | 12 Feb 2025 | 20 Feb 20258 days later | 6.5 Medium | Vendor |
| CVE-2025-0108Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | PAN-OS | 12 Feb 2025 | 18 Feb 20256 days later | 9.1 Critical | Vendor |
| CVE-2024-3393Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability | PAN-OS | 27 Dec 2024 | 30 Dec 20243 days later | 7.5 High | Vendor |
| CVE-2024-9474Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability | PAN-OS | 18 Nov 2024 | 18 Nov 2024same day or before NVDUsed in ransomware | 7.2 High | Vendor |
| CVE-2024-0012Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability | PAN-OS | 18 Nov 2024 | 18 Nov 2024same day or before NVDUsed in ransomware | 9.8 Critical | Vendor |
| CVE-2024-3400Palo Alto Networks PAN-OS Command Injection Vulnerability | PAN-OS | 12 Apr 2024 | 12 Apr 2024same day or before NVDUsed in ransomware | 10.0 Critical | Vendor |
| CVE-2022-0028Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability | PAN-OS | 10 Aug 2022 | 22 Aug 202212 days later | 8.6 High | Vendor |
| CVE-2017-15944Palo Alto Networks PAN-OS Remote Code Execution Vulnerability | PAN-OS | 11 Dec 2017 | 18 Aug 20221711 days later | 9.8 Critical | Vendor |
| CVE-2020-2021Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | PAN-OS | 29 Jun 2020 | 25 Mar 2022634 days laterUsed in ransomware | 10.0 Critical | — |
| CVE-2019-1579Palo Alto Networks PAN-OS Remote Code Execution Vulnerability | PAN-OS | 19 Jul 2019 | 10 Jan 2022906 days laterUsed in ransomware | 8.1 High | — |
What to do
- Match the product and version on your appliance against the vendor advisory linked in the row (where none is shown, use the references on the NVD page), and install the fixed release it names.
- CISA’s required action is to apply the vendor’s updates or mitigations, or stop using the product where none exist; recent entries add CISA’s own hunt or forensic-triage steps, and end-of-life products are to be disconnected. US federal civilian agencies must act by a deadline; everyone else faces the same risk.
- Keep the management interface and the VPN portal off the public internet where you can, and restrict them to known addresses where you cannot.
- A patch does not remove an attacker who got in first. For any flaw on this list, look for the vendor’s or CISA’s guidance on signs of compromise, not just the fix.
How this list is kept
- A row appears when CISA adds the flaw to its Known Exploited Vulnerabilities catalog: attackers are using it, not just able to. The catalog is re-read every week.
- Scope is the perimeter appliance: firewalls, SSL-VPN and remote-access gateways, and the delivery controllers that terminate remote access. Email gateways, sandboxes, management consoles and endpoint tools from the same vendors are left out.
- Publication date and CVSS score are NVD’s. “Days later” counts from NVD publication to the KEV listing; “same day or before NVD” means CISA listed the flaw no later than NVD published it. The catalog began on 3 Nov 2021, so older flaws listed that day count to the catalog’s start, not to when exploitation was first reported; the medians leave them out.
- “Used in ransomware” is CISA’s own field, set when a ransomware campaign is known to have used the flaw. How the data pages are built.