Palo Alto Networks — Security Activity Report

PAN-OS, GlobalProtect, Prisma, Cortex (PSIRT advisories)

Generated Nov 13, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 714 CVEs with Palo Alto Networks advisories. Source: NVD CVE records joined with vendor advisory publish dates.

29202241202310520241452025972026

Severity Composition

↓ -4.8 pp

50.1% of Palo Alto Networks's 714 CVEs are CRITICAL or HIGH severity. Industry median: 54.9%. Source: NVD CVSS v3.1.

CRITICAL 65 (9.1%)HIGH 293 (41.0%)MEDIUM 285 (39.9%)LOW 37 (5.2%)NONE 34 (4.8%)

CISA KEV Listings

↑ +3.9 pp

16 of 355 Palo Alto Networks CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (4.5%). Industry median: 0.6%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↑ +3.9 days

Median time from CVE disclosure to Palo Alto Networks advisory: 15 days (p25 7 days – p75 28 days). Industry median: 11 days.

Sample size: 150 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across Palo Alto Networks's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

  • CWE-416Use After Free32 CVEs
  • CWE-79Cross-site Scripting (XSS)22 CVEs
  • CWE-754Improper Check for Unusual or Exceptional Conditions19 CVEs
  • CWE-787Out-of-bounds Write19 CVEs
  • CWE-78OS Command Injection16 CVEs

Recent Security Advisories

Latest advisories published by Palo Alto Networks, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

  • NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
  • MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
  • CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
  • Vendor security advisories (Red Hat RHSA, Ubuntu USN, Microsoft MSRC, Cisco PSIRT and other per-vendor feeds; the GitHub and OSV advisory databases are not used) — published_at timestamps
  • MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Nov 13, 2026: when these counts and industry medians were computed. Vendors in the index are recomputed every 6 hours.

Spot a factual error in this report?

Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.