Home  :  Support   :  Security Advisories

Security Advisories

This section provides a listing of all security vulnerabilities identified in currently supported Palo Alto Networks products. Each vulnerability is given a criticality rating and an updated status on any updates or mitigations regarding each discovered vulnerablity. Each vulnerability listing also provides a list of the versions of PAN OS the vulnerability is known to affect.

Please disclose vulnerability discoveries to the Palo Alto Networks Product Security Incident Response Team (PSIRT)

Security Advisory Listing

 Title  ID  Severity  Products Affected  First  Published  Last  Updated
Detail
OpenSSL Vulnerabilities in PAN-OS
PAN-SA-2018-0015 Medium PAN-OS 6.1.20 and earlier, PAN-OS 7.1.20 and earlier, PAN-OS 8.0.13 and earlier, and PAN-OS 8.1.3 and earlier. 10/11/2018 10/11/2018
Detail
Cross-Site Scripting (XSS) in GlobalProtect Portal Login Page
PAN-SA-2018-0014 High PAN-OS 8.1.3 and earlier. PAN-OS 8.0, PAN-OS 7.1 and PAN-OS 6.1 are NOT affected. 10/11/2018 10/11/2018
Detail
Information about FragmentSmack findings
PAN-SA-2018-0012 Medium PAN-OS 6.1.21 and earlier running on PA-200, PA-500, PA-2000 Series, PA-3000 Series, PA-4000 Series, PA-5000 Series, PA-7050. PAN-OS 7.1.19 and earlier running on PA-200, PA-500, PA-2000 Series, PA-3000 Series, PA-4000 Series, PA-5000 Series, PA-7050 and PA-7080. PAN-OS 8.0.12 and earlier running on PA-200, PA-220, PA-500, PA-800 Series, PA-3000 Series, PA-5000 Series, PA-5220, PA-5250, PA-5260, PA-7050 and PA-7080. PAN-OS 8.1.3 and earlier running on PA-200, PA-220, PA-220R, PA-500, PA-800 Series, PA-3000 Series, PA-3200 Series, PA-5000 Series, PA-5220, PA-5250, PA-5260, PA-5280, PA-7050 and PA-7080. 09/19/2018 10/08/2018
Detail
Information about SegmentSmack findings
PAN-SA-2018-0013 Info N/A 09/19/2018 09/19/2018
Detail
Information about L1 Terminal Fault findings
PAN-SA-2018-0011 Info N/A 08/17/2018 08/17/2018
Detail
Cross-Site Scripting (XSS) in GlobalProtect Gateway
PAN-SA-2018-0009 Medium PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier. PAN-OS 8.1.0 is NOT affected. 08/15/2018 08/17/2018
Detail
Denial of Service in PAN-OS Management Web Interface
PAN-SA-2018-0010 Low PAN-OS 8.1.2 and earlier. PAN-OS 6.1, PAN-OS 7.1 and PAN-OS 8.0 are NOT affected. 08/15/2018 08/15/2018
Detail
Denial of Service in PAN-OS Management Web Interface
PAN-SA-2018-0008 High PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.0. Global Protect is NOT affected. 07/19/2018 07/19/2018
Detail
Information Disclosure in the PAN-OS Management Web Interface
PAN-SA-2018-0005 Low PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.8 and earlier, and PAN-OS 8.1.0 06/28/2018 07/09/2018
Detail
Local Privilege Escalation in Management Web Interface
PAN-SA-2018-0004 Low PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier. PAN-OS 8.1 is not affected. 06/28/2018 06/28/2018
Detail
Cross-Site Scripting (XSS) in PAN-OS Management Web Interface
PAN-SA-2018-0006 Medium PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier 06/28/2018 06/28/2018
Detail
Cross-Site Scripting (XSS) in PAN-OS Management Web Interface
PAN-SA-2018-0007 Medium PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier 06/28/2018 06/28/2018
Detail
Cross Site Scripting in PAN-OS
PAN-SA-2018-0003 Medium PAN-OS major release PAN-OS 8.0 is affected (PAN-OS 8.0.10 and earlier). Other PAN-OS major releases are not affected (8.1.x, 7.1.x, 6.1.x). 06/26/2018 06/26/2018
Detail
Meltdown and Spectre update for WildFire-500 Appliance
PAN-SA-2018-0002 Low WF-500 (WildFire Appliance) running appliance software versions 8.0.9 and earlier; all versions of 7.1, 7.0, and 6.1. Please note: WF-500 appliance software versions 8.1.0 and later are not impacted by this advisory. 05/15/2018 05/16/2018
Detail
ROBOT attack against PAN-OS
PAN-SA-2017-0032 High PAN-OS 6.1.19 and earlier, PAN-OS 7.1.14 and earlier, PAN-OS 8.0.6-h3 and earlier 01/02/2018 03/13/2018
Detail
Information about Meltdown and Spectre findings
PAN-SA-2018-0001 Info N/A 01/04/2018 01/11/2018
Detail
Command Injection in PAN-OS
PAN-SA-2017-0028 High PAN-OS 6.1.18 and earlier, PAN-OS 7.0.18 and earlier, PAN-OS 7.1.13 and earlier, PAN-OS 8.0.6 and earlier 12/05/2017 01/09/2018
Detail
Vulnerability in PAN-OS and Panorama on Management Interface
PAN-SA-2017-0027 Critical PAN-OS 6.1.18 and earlier, PAN-OS 7.0.18 and earlier, and PAN-OS 7.1.13 and earlier. 12/05/2017 01/06/2018
Detail
Cross Site Scripting in PAN-OS Captive Portal
PAN-SA-2017-0031 Medium PAN-OS 8.0.6-h3 and earlier. 01/02/2018 01/02/2018
Detail
Cross Site Scripting Vulnerability in PAN-OS GlobalProtect
PAN-SA-2017-0030 Medium PAN-OS 6.1.18 and earlier, PAN-OS 7.0.18 and earlier, PAN-OS 7.1.13 and earlier, PAN-OS 8.0.6-h3 and earlier. 01/02/2018 01/02/2018
Detail
Denial of Service Against GlobalProtect
PAN-SA-2017-0025 High PAN-OS 6.1.18 and earlier, PAN-OS 7.0.18 and earlier, PAN-OS 7.1.12 and earlier, PAN-OS 8.0.5 and earlier 12/05/2017 12/15/2017
Detail
Global Protect Vulnerability
PAN-SA-2017-0029 Low GlobalProtect agent for macOS 4.0.2 and earlier 12/05/2017 12/14/2017
Detail
Server-Side Request Forgery in PAN-OS
PAN-SA-2017-0026 Low PAN-OS 6.1.18 and earlier, PAN-OS 7.0.18 and earlier, PAN-OS 7.1.13 and earlier 12/05/2017 12/05/2017
Detail
NTP Vulnerability
PAN-SA-2017-0022 Low PAN-OS 6.1, PAN-OS 7.0.17 and earlier, PAN-OS 7.1.11 and earlier, PAN-OS 8.0.3 and earlier 07/27/2017 09/11/2017
Detail
Cross-Site Scripting in PAN-OS
PAN-SA-2017-0023 Medium PAN-OS 6.1.17 and earlier, PAN-OS 7.0.16 and earlier, PAN-OS 7.1.11 and earlier, PAN-OS 8.0.2 and earlier 08/30/2017 08/31/2017