Palo Alto Networks — Security Activity Report
PAN-OS, GlobalProtect, Prisma, Cortex (PSIRT advisories)
Generated Sep 19, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗
CVE Disclosure Volume
Total all-time: 65 CVEs with Palo Alto Networks advisories. Source: NVD CVE records joined with vendor advisory publish dates.
Severity Composition
↑ +5.4 pp58.5% of Palo Alto Networks's 65 CVEs are CRITICAL or HIGH severity. Industry median: 53.1%. Source: NVD CVSS v3.1.
CISA KEV Listings
↑ +2.3 pp2 of 65 Palo Alto Networks CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (3.1%). Industry median: 0.8%.
Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.
Vendor Patch Velocity
↓ -1.5 daysMedian time from CVE disclosure to Palo Alto Networks advisory: 7 days (p25 7 days – p75 7 days). Industry median: 9 days.
Sample size: 10 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.
Top Recurring Weakness Classes
Most-frequently mapped CWEs across Palo Alto Networks's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.
Recent Security Advisories
Latest advisories published by Palo Alto Networks, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.
- CVE-2026-0308LowSep 9, 2026
CVE-2026-0308 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- CVE-2026-0307MediumSep 9, 2026
CVE-2026-0307 GlobalProtect App: Local Privilege Escalation Vulnerabilities
- CVE-2026-0305MediumSep 9, 2026
CVE-2026-0305 Prisma Access Agent: Information Disclosure Vulnerability on Linux
- CVE-2026-0309MediumSep 9, 2026
CVE-2026-0309 PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration
- CVE-2026-0302LowSep 9, 2026
CVE-2026-0302 Checkov by Prisma Cloud: OS Command Injection Vulnerability
- PAN-SA-2026-0012HighSep 9, 2026
PAN-SA-2026-0012 Chromium: Monthly Vulnerability Update (September 2026)
- CVE-2026-0304MediumSep 9, 2026
CVE-2026-0304 Cortex XDR Broker VM: Privilege Escalation Vulnerability
- CVE-2026-0306MediumSep 9, 2026
CVE-2026-0306 Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows
Full advisory archive: /pulse/vendor-advisories →
Data sources & corrections
- NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
- MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
- CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
- Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
- MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings
Snapshot generated Sep 19, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.
Spot a factual error in this report?
Email [email protected] with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.