Palo Alto Networks Security Advisories
paloalto-psirt · A · active
https://security.paloaltonetworks.com/
Added 2026-09-29: first-party PSIRT for PAN-OS / GlobalProtect / Prisma, an edge-device line with repeated in-the-wild exploitation; until now only reached through CERT relays. RECIPE: `feed https://security.paloaltonetworks.com/rss.xml 10` (direct, newest CVE-2026-0307 GlobalProtect 2026-09-23 at probe), then `extract` the per-advisory page for the affected/fixed version table. (2026-09-29 operator-directed setup review) | 2026-10-26 (S1): `extract` of a PAN advisory drops the Timeline (revision log); `url --direct https://security.paloaltonetworks.com/CVE-2026-109618` keeps it, so use it for revision checks. | 2026-10-28 (S1): https://security.paloaltonetworks.com/json/CVE-<id> returns the advisory as CVE JSON with `exploits`, CVSS 4.0 metrics and a timestamped timeline; extract of the HTML page drops the Timeline.
Cited in 9 entries
Citation cadence
Citation days per ISO week (24 weeks of coverage span, total 7).
- CVE-2026-111497, Node.js and Google Brotli (Node2Shell): an out-of-bounds write in the Brotli decoder lets crafted compressed data run code, reached through fetch() and Express 5 or body-parser 2 request bodies; fixed in Node.js 22.23.4, 24.22.1 and 26.12.1 and in the PyPI packages Brotli 1.2.1 and brotlicffi 1.2.1.0 (CVSS 4.0 9.2)2026-10-24
- CVE-2026-109618 / CVE-2026-109619, Palo Alto Networks PAN-OS and Panorama: the PHP2Shell flaws affect every release below its train's hotfix through the management web interface, and Palo Alto reports active exploitation against internet-exposed management interfaces; all twenty hotfixes are out2026-10-22
- k0t: Group-IB and NyxLab describe a probable access broker that mass-exploits FortiWeb and PAN-OS GlobalProtect, brute-forces FortiGate and decrypts stolen FortiGate configurations offline with the default key, with victims later listed by Qilin and The Gentlemen2026-10-22
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)2026-10-21
- CVE-2026-0322, Palo Alto Networks PAN-OS: code injection in the management interface gives an authenticated attacker root, exploited in very limited attacks and listed in CISA KEV (CVSS-B 8.6)2026-10-15
- CVE-2026-48907, Widget Factory Joomla Content Editor (JCE) before version 2.9.99.5: unauthenticated profile-import → PHP RCE (CVSS v4 10.0)2026-06-17
- CVE-2026-48710 "BadHost", Starlette (FastAPI / vLLM / LiteLLM / MCP SDK): Pre-Auth Auth Bypass via Malformed Host Header2026-05-30
- CVE-2026-0257, Palo Alto PAN-OS GlobalProtect: pre-auth authentication bypass via certificate reuse, marked by CISA as used in ransomware campaigns2026-05-30
- CVE-2026-0300: PAN-OS User-ID Authentication Portal unauthenticated root RCE, exploited by a likely state-sponsored cluster; fixed builds for every supported branch2026-05-12