CVE-2026-0282PAN-OS: File Deletion Vulnerability in Management Web Interface

A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory. The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.

2.7 LOWEPSS 0.29%Not in KEVNVD: Modified

Last updated: 2026-10-15 01:11 UTC

OverviewCVSS details

2.7LOWCVSS 4.0

Score source: palo_alto (CNA)
NVD status: Modified
Published: Jul 9, 2026
Assigner: palo_alto

Affected

Cloud NGFW (Palo Alto Networks)

+2 more products →

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation none · Automatable no · Impact partial

EPSS · FIRST, scored Nov 7

0.29%chance of exploitation in 30 days

Higher than 22.04% of CVEs

CVSS 4.0 · palo_alto (CNA)

2.7Low

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: None
Integrity impact: Low
Availability impact: Low
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 4.0 · palo_alto (CNA)

1.2Low

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

Attack vector: Local
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: None
Integrity impact: Low
Availability impact: Low
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

6.5Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: None
Integrity impact: Low
Availability impact: Low

NVD status: Modified

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
2.7	LOW	4.0palo_alto (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
1.2	LOW	4.0palo_alto (CNA)	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
6.5	MEDIUM	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Details

CVE ID: CVE-2026-0282
Status: Modified
Assigner (CNA): palo_alto
Published: Jul 9, 2026
Last modified: 2026-10-15 01:11 UTC
Weaknesses: CWE-20 · Improper Input Validation

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:52 UTC.