CVE-2026-0301

Published: Aug 13, 2026Modified: Aug 28, 2026

1.7

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:AmberShow less

Source: psirt@paloaltonetworks.com (Secondary)

Description

An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability.

Affected (7)

Products: Paloaltonetworks: Cloud Ngfw, Pan Os, Prisma Access

3 products

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Paloaltonetworks Cloud Ngfw	All versions
Paloaltonetworks Cloud Ngfw	All versions
Paloaltonetworks Pan Os	From 10.2.0 to 10.2.8
Paloaltonetworks Pan Os	From 11.1.0 to 11.1.16
Paloaltonetworks Pan Os	Version 11.1.16
Paloaltonetworks Prisma Access	Before 6.0.0
Paloaltonetworks Prisma Access	Before 6.0.0

Related CWEs

CWE-908

Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

References (1)

https://security.paloaltonetworks.com/CVE-2026-0301

Source: psirt@paloaltonetworks.com

Vendor Advisory

Timeline

No history available yet.