Vendor History
Palo Alto Networks security incident history
Updated . Data gathered daily from official public sources.
As of Oct 26, 2026, Vendor History found 16 actively exploited security flaws for Palo Alto Networks, dated Jan 10, 2022 to Oct 14, 2026. Sources checked: the California and Washington Attorney General breach lists, SEC EDGAR (Form 8-K, Item 1.05) and CISA's Known Exploited Vulnerabilities catalog.
Breach notices and SEC cyber filings
None found in the sources we check.
Got a breach letter from Palo Alto Networks? What to do when a vendor has a data breach.
Actively exploited security flaws
Flaws in Palo Alto Networks products that CISA lists as exploited by attackers. If you use an affected product, check that it's updated. What a listing means.
-
Palo Alto Networks PAN-OS Code Injection Vulnerability (CVE-2026-0322). Added to CISA's list of security flaws known to be exploited by attackers.
-
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (CVE-2026-0257). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability (CVE-2026-0300). Added to CISA's list of security flaws known to be exploited by attackers.
-
Palo Alto Networks PAN-OS File Read Vulnerability (CVE-2025-0111). Added to CISA's list of security flaws known to be exploited by attackers.
-
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (CVE-2025-0108). Added to CISA's list of security flaws known to be exploited by attackers.
-
Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability (CVE-2024-3393). Added to CISA's list of security flaws known to be exploited by attackers.
-
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability (CVE-2024-0012). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability (CVE-2024-9474). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Palo Alto Networks Expedition OS Command Injection Vulnerability (CVE-2024-9463). Added to CISA's list of security flaws known to be exploited by attackers.
-
Palo Alto Networks Expedition SQL Injection Vulnerability (CVE-2024-9465). Added to CISA's list of security flaws known to be exploited by attackers.
-
Palo Alto Networks Expedition Missing Authentication Vulnerability (CVE-2024-5910). Added to CISA's list of security flaws known to be exploited by attackers.
-
Palo Alto Networks PAN-OS Command Injection Vulnerability (CVE-2024-3400). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability (CVE-2022-0028). Added to CISA's list of security flaws known to be exploited by attackers.
-
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability (CVE-2017-15944). Added to CISA's list of security flaws known to be exploited by attackers.
-
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (CVE-2020-2021). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
-
Palo Alto Networks PAN-OS Remote Code Execution Vulnerability (CVE-2019-1579). Added to CISA's list of security flaws known to be exploited by attackers. CISA lists it as used in ransomware campaigns.
We check: California and Washington Attorney General breach notices, SEC cyber incident filings (Form 8-K, Item 1.05) and CISA's catalog of actively exploited security flaws. An empty section means we found nothing in those sources. It does not mean nothing happened. How it works
To cite: Vendor History, "Palo Alto Networks security incident history," vendorhistory.com/vendor/palo-alto-networks, data checked Oct 26, 2026. Free to reuse under CC BY 4.0 with credit to Vendor History.