Alertas de Seguridad de la Información

P Medio vulnerabilidad

12/08/2026

CVE-2026-0298 GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0298 GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP) (Severity: MEDIUM). Tipo: Vulnerabilidad de seguridad. Producto afectado: GlobalProtect.

firewallngfwglobalprotect PAN PSIRT

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0276] A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally a…

A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user.

nvdaltovulnerabilidad CVSS 7.8 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0286] A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software ena…

A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls an…

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0287] Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthent…

Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Panorama is not impacted by these vulnerab…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Crítico vulnerabilidad

09/07/2026

[CVE-2026-0284] An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PA…

An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

nvdcriticovulnerabilidad CVSS 9.9 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0283] An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networ…

An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0280] An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enab…

An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services. Cloud NGFW and Panorama are not impacted by this vulnerability.

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0281] An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenti…

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The security risk posed by this issue is minimized by restricting access to the management web interface to o…

nvdaltovulnerabilidad CVSS 7.1 NVD

P Alto vulnerabilidad

08/07/2026

[CVE-2026-0288] Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Pal…

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic. The security risk posed by this issue is minimized when the User-ID Terminal Server …

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

08/07/2026

CVE-2026-0279 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0279 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities (Severity: LOW). Tipo: Cross-Site Scripting (XSS). Producto afectado: PAN-OS.

firewallngfwpan-os PAN PSIRT

P Medio vulnerabilidad

08/07/2026

CVE-2026-0277 Prisma Access Agent: Improper Certificate Validation on iOS

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0277 Prisma Access Agent: Improper Certificate Validation on iOS (Severity: MEDIUM). Tipo: Vulnerabilidad de seguridad. Producto afectado: Prisma Access.

firewallngfwprisma-access PAN PSIRT

P Medio vulnerabilidad

08/07/2026

CVE-2026-0282 PAN-OS: File Deletion Vulnerability in Management Web Interface

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0282 PAN-OS: File Deletion Vulnerability in Management Web Interface (Severity: LOW). Tipo: Vulnerabilidad de seguridad. Producto afectado: PAN-OS.

firewallngfwpan-os PAN PSIRT

P Medio vulnerabilidad

08/07/2026

CVE-2026-0285 PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0285 PAN-OS: Server-Side Request Forgery Vulnerability in Management Web Interface (Severity: MEDIUM). Tipo: Server-Side Request Forgery (SSRF). Producto afectado: PAN-OS.

firewallngfwpan-os PAN PSIRT

P Alto vulnerabilidad

08/07/2026

PAN-SA-2026-0010 Chromium and Prisma Browser: Monthly Vulnerability Update (July 2026)

Palo Alto Networks PSIRT publica advisory de seguridad: PAN-SA-2026-0010 Chromium and Prisma Browser: Monthly Vulnerability Update (July 2026) (Severity: HIGH). Tipo: Vulnerabilidad de seguridad. Producto afectado: Palo Alto Networks.

firewallngfw PAN PSIRT

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0271] A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux…

A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux devices enables a local user to execute code with elevated privileges. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.

nvdaltovulnerabilidad CVSS 7.8 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0272] A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated …

A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management inte…

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0273] A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated ad…

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administ…

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0270] A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux …

A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Medio vulnerabilidad

10/06/2026

CVE-2026-0267 GlobalProtect App: Information Exposure Vulnerability on macOS

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0267 GlobalProtect App: Information Exposure Vulnerability on macOS (Severity: MEDIUM). Tipo: Vulnerabilidad de seguridad. Producto afectado: GlobalProtect.

firewallngfwglobalprotect PAN PSIRT

P Crítico vulnerabilidad

10/06/2026

CVE-2026-0268 Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0268 Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux (Severity: MEDIUM). Tipo: Vulnerabilidad de seguridad. Producto afectado: Prisma Access.

firewallngfwprisma-access PAN PSIRT