CVE-2026-0285

UNKNOWN 0.0

PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services. The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

CWE	CWE-918
Vendor	palo alto networks
Product	cloud ngfw
Published	Jul 9, 2026
Last Updated	Jul 9, 2026

Stay Ahead of the Next One

Get instant alerts for palo alto networks cloud ngfw

Be the first to know when new unknown vulnerabilities affecting palo alto networks cloud ngfw are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Palo Alto Networks / Cloud NGFW

All versions affected

Palo Alto Networks / PAN-OS

12.1.0 < 12.1.8 11.2.0 < 11.2.13 11.1.0 < 11.1.16 10.2.0 < 10.2.18-h8

Palo Alto Networks / Prisma Access

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

security.paloaltonetworks.com: https://security.paloaltonetworks.com/CVE-2026-0285

Credits

our internal security research teams