PT-2026-56914 · Palo Alto Networks · Cloud Ngfw+2

Publicado 2026-07-09 · Atualizado 2026-07-09 · CVE-2026-0285

NVD

CVSS v4.0

4.7

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with network access to the management web interface to make unauthorized requests from the firewall to internal services.

The security risk posed by this issue is minimized when the management interface is restricted to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . 

Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-0285

Produtos afetados

Cloud Ngfw

Pan-Os

Prisma Access

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-0285 · Nota de Segurança
• https://security.paloaltonetworks.com/CVE-2026-0285 · Aviso do Fabricante