CVE-2026-0281PAN-OS: Information Disclosure Vulnerability in Management Web Interface

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

2.1 LOWEPSS 0.28%Not in KEVNVD: Modified

Last updated: 2026-10-15 01:11 UTC

OverviewCVSS details

2.1LOWCVSS 4.0

Score source: palo_alto (CNA)
NVD status: Modified
Published: Jul 9, 2026
Assigner: palo_alto

Affected

Cloud NGFW (Palo Alto Networks)

+2 more products →

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation none · Automatable no · Impact partial

EPSS · FIRST, scored Nov 7

0.28%chance of exploitation in 30 days

Higher than 20.98% of CVEs

CVSS 4.0 · palo_alto (CNA)

2.1Low

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: Active
Confidentiality impact: High
Integrity impact: Low
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 4.0 · palo_alto (CNA)

1.7Low

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber

Attack vector: Local
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: Active
Confidentiality impact: High
Integrity impact: Low
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

7.1High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality impact: High
Integrity impact: Low
Availability impact: None

NVD status: Modified

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
2.1	LOW	4.0palo_alto (CNA)	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber
1.7	LOW	4.0palo_alto (CNA)	CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:M/U:Amber
7.1	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Details

CVE ID: CVE-2026-0281
Status: Modified
Assigner (CNA): palo_alto
Published: Jul 9, 2026
Last modified: 2026-10-15 01:11 UTC
Weaknesses: CWE-524 · Use of Cache Containing Sensitive Information

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:52 UTC.