Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Security vendor · Firewalls and NGFW · in CISA KEV

Palo Alto Networks in the CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog lists 16 entries for Palo Alto Networks as of catalog version 2026.11.06, released November 6, 2026. The newest was added October 14, 2026, and the latest federal due date is October 17, 2026. CISA marks 6 of them as known ransomware use.

Updated

entries in the catalog
16
newest addition
October 14, 2026
latest federal due date
October 17, 2026
marked known ransomware use
6

Directory record

Website
www.paloaltonetworks.com
Categories
Firewalls and NGFW (primary), Cloud-native application protection (CNAPP), EDR and XDR, Privileged access management
Headquarters
Santa Clara, United States
Founded
2005
Ownership
Public (NASDAQ: PANW)
Company record
Palo Alto Networks on CISO Tribune

Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.

KEV entries, newest first

Filed by CISA under the name “Palo Alto Networks”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

  1. Added October 14, 2026

    CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability

    PAN-OS · on must-patch

    Due October 17, 2026

  2. Added May 29, 2026

    CVE-2026-0257 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

    PAN-OS · known ransomware use

    Due June 1, 2026

  3. Added May 6, 2026

    CVE-2026-0300 Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

    PAN-OS

    Due May 9, 2026

  4. Added February 20, 2025

    CVE-2025-0111 Palo Alto Networks PAN-OS File Read Vulnerability

    PAN-OS

    Due March 13, 2025

  5. Added February 18, 2025

    CVE-2025-0108 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

    PAN-OS

    Due March 11, 2025

  6. Added December 30, 2024

    CVE-2024-3393 Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability

    PAN-OS

    Due January 20, 2025

  7. Added November 18, 2024

    CVE-2024-9474 Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability

    PAN-OS · known ransomware use

    Due December 9, 2024

  8. Added November 18, 2024

    CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability

    PAN-OS · known ransomware use

    Due December 9, 2024

  9. Added November 14, 2024

    CVE-2024-9465 Palo Alto Networks Expedition SQL Injection Vulnerability

    Expedition

    Due December 5, 2024

  10. Added November 14, 2024

    CVE-2024-9463 Palo Alto Networks Expedition OS Command Injection Vulnerability

    Expedition

    Due December 5, 2024

  11. Added November 7, 2024

    CVE-2024-5910 Palo Alto Networks Expedition Missing Authentication Vulnerability

    Expedition

    Due November 28, 2024

  12. Added April 12, 2024

    CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection Vulnerability

    PAN-OS · known ransomware use

    Due April 19, 2024

  13. Added August 22, 2022

    CVE-2022-0028 Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability

    PAN-OS

    Due September 12, 2022

  14. Added August 18, 2022

    CVE-2017-15944 Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

    PAN-OS

    Due September 8, 2022

  15. Added March 25, 2022

    CVE-2020-2021 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

    PAN-OS · known ransomware use

    Due April 15, 2022

  16. Added January 10, 2022

    CVE-2019-1579 Palo Alto Networks PAN-OS Remote Code Execution Vulnerability

    PAN-OS · known ransomware use

    Due July 10, 2022

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.

On Daily CISO, newest first

  1. Daily briefing · October 24, 2026

    CISA reinforces urgent patching for critical php2shell PHP flaws

  2. Weekly archive · Oct 12 – Oct 18, 2026

    CISA Adds Four More Exploited Vulnerabilities to KEV Catalog

  3. Weekly archive · May 25 – May 31, 2026

    CISA Adds PAN-OS Authentication Bypass to KEV Catalog

  4. Weekly archive · May 4 – May 10, 2026

    Palo Alto says nation-state actors likely behind PAN-OS firewall zero-day

  5. Weekly archive · Jul 28 – Aug 3, 2025

    Palo Alto Networks agrees to buy CyberArk for about $25 billion

  6. Weekly archive · Apr 21 – Apr 27, 2025

    Security Leadership Moves: F5, Palo Alto Networks, Vaultree

  7. Weekly archive · Feb 17 – Feb 23, 2025

    CISA Flags Craft CMS and a Second PAN-OS Bug as Actively Exploited

  8. Weekly archive · Feb 10 – Feb 16, 2025

    PAN-OS authentication bypass fixed as a proof of concept goes public

  9. Weekly archive · Dec 30 – Jan 5, 2025

    PAN-OS DNS denial-of-service bug added to the KEV catalog

  10. Weekly archive · Nov 18 – Nov 24, 2024

    Two exploited PAN-OS zero-days lead to about 2,000 compromised firewalls

  11. Weekly archive · Nov 11 – Nov 17, 2024

    CISA Adds Two Palo Alto Expedition Flaws to KEV Catalog

  12. Weekly archive · Nov 11 – Nov 17, 2024

    Palo Alto Networks Warns on Exposed Firewall Management Interfaces

  13. Weekly archive · Nov 4 – Nov 10, 2024

    CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog

  14. Weekly archive · Apr 15 – Apr 21, 2024

    Palo Alto Networks Confirms Telemetry Mitigation Ineffective for CVE-2024-3400

  15. Weekly archive · Apr 8 – Apr 14, 2024

    Palo Alto Networks PAN-OS Zero-Day Added to CISA's KEV Catalog

Sources

  1. Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
  2. Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
  3. CISO Tribune, vendor directory record for Palo Alto Networks, published November 8, 2026