CVE-2026-0281— PAN-OS: Information Disclosure Vulnerability in Management Web Interface
Possible ATT&CK Techniques 2AI
T1556.004 · Network Device Authentication T1557 · Adversary-in-the-MiddleAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Palo Alto Networks | Cloud NGFW | All | unaffected |
| Palo Alto Networks | PAN-OS | 12.1.0< 12.1.8 | affected |
11.2.0< 11.2.13 | affected | ||
11.1.0< 11.1.16 | affected | ||
10.2.0< 10.2.18-h8 | affected | ||
| Palo Alto Networks | Prisma Access | All | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-0281
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PAN-OS: Information Disclosure Vulnerability in Management Web Interface
Source: NVD (National Vulnerability Database)
Vulnerability Description
An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过缓存导致的信息暴露
Source: NVD (National Vulnerability Database)
Vulnerability Title
Palo Alto Networks Cloud NGFW 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Palo Alto Networks Cloud NGFW是美国Palo Alto Networks公司的防火墙。 Palo Alto Networks Cloud NGFW存在信息泄露漏洞，该漏洞源于信息泄露问题，可能导致未经身份验证的攻击者通过网络访问管理Web界面获取Web会话令牌。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Palo Alto Networks | Cloud NGFW | - | - | |
| Palo Alto Networks | PAN-OS | 12.1.0 ~ 12.1.8 | cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:* | |
| Palo Alto Networks | Prisma Access | - | - |
II. Public POCs for CVE-2026-0281
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-0281
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-0281 (1)
Same Patch Batch · Palo Alto Networks · 2026-07-09 · 13 CVEs total
| CVE-2026-0275 | Prisma Browser: Local Privilege Escalation on macOS | |
| CVE-2026-0276 | Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerability | |
| CVE-2026-0277 | Prisma Access Agent: Improper Certificate Validation on iOS | |
| CVE-2026-0278 | Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows | |
| CVE-2026-0279 | PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities | |
| CVE-2026-0280 | PAN-OS: IPv6 Firewall Policy Bypass | |
| CVE-2026-0282 | PAN-OS: File Deletion Vulnerability in Management Web Interface | |
| CVE-2026-0283 | PAN-OS: Authentication Bypass Vulnerability in Large Scale VPN (LSVPN) | |
| CVE-2026-0284 | PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVPN) | |
| CVE-2026-0285 | PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface | |
| CVE-2026-0286 | PAN-OS: Authenticated Command Injection in CLI | |
| CVE-2026-0287 | PAN-OS: Denial of Service Vulnerabilities in Network Traffic Processing |
IV. Related Vulnerabilities
Same product: Cloud NGFW
- CVE-2026-0279
PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities - CVE-2026-0280
PAN-OS: IPv6 Firewall Policy Bypass - CVE-2026-0282
PAN-OS: File Deletion Vulnerability in Management Web Interf - CVE-2026-0283
PAN-OS: Authentication Bypass Vulnerability in Large Scale V - CVE-2026-0284
PAN-OS: XML Injection Vulnerability in Large Scale VPN (LSVP
Same vendor: Palo Alto Networks
- CVE-2026-0275
Prisma Browser: Local Privilege Escalation on macOS - CVE-2026-0276
Cortex XDR Broker VM: Privilege Escalation (PE) Vulnerabilit - CVE-2026-0277
Prisma Access Agent: Improper Certificate Validation on iOS - CVE-2026-0278
Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilit - CVE-2026-0279
PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities
Same weakness: CWE-524
- CVE-2026-61836
Directus: Authorization-dependent response served from unseg - CVE-2026-59213
Open WebUI: Cross-user model-list exposure via static cache - CVE-2026-48588
Potential exposure of private data via cached Set-Cookie res - CVE-2026-49858
API Platform Core: Cross-user attribute leak in JSON:API and - CVE-2026-53943
Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-pre
V. Comments for CVE-2026-0281
No comments yet