CVE-2026-0285PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface

A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

4.7 MEDIUMEPSS 0.43%Not in KEVNVD: Modified

Last updated: 2026-10-25 17:10 UTC

OverviewCVSS details

4.7MEDIUMCVSS 4.0

Score source: palo_alto (CNA)
NVD status: Modified
Published: Jul 9, 2026
Assigner: palo_alto

Affected

Cloud NGFW (Palo Alto Networks)

+2 more products →

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation none · Automatable no · Impact partial

EPSS · FIRST, scored Nov 7

0.43%chance of exploitation in 30 days

Higher than 37.63% of CVEs

CVSS 4.0 · palo_alto (CNA)

4.7Medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality impact: Low
Integrity impact: High
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 4.0 · palo_alto (CNA)

4.4Medium

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

Attack vector: Adjacent
Attack complexity: Low
Attack requirements: None
Privileges required: High
User interaction: None
Confidentiality impact: Low
Integrity impact: High
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

4.9Medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality impact: None
Integrity impact: High
Availability impact: None

NVD status: Modified

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
4.7	MEDIUM	4.0palo_alto (CNA)	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
4.4	MEDIUM	4.0palo_alto (CNA)	CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
4.9	MEDIUM	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Details

CVE ID: CVE-2026-0285
Status: Modified
Assigner (CNA): palo_alto
Published: Jul 9, 2026
Last modified: 2026-10-25 17:10 UTC
Weaknesses: CWE-918 · Server-Side Request Forgery (SSRF)

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:52 UTC.