https://patchfirst.co/vendor/palo-alto-networks/New and newly exploited Palo Alto Networks CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-0322/CVE-2026-0322#kevWed, 14 Oct 2026 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2026-10-14. ENISA EUVD lists it as exploited. EPSS 1.7% (higher than 77.7% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 73.6 of 100.kevpublic-exploitT1078T1059https://patchfirst.co/cve/CVE-2026-0257/CVE-2026-0257#kevFri, 29 May 2026 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2026-05-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 95.0% (higher than 99.86% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1133 External Remote Services. Named in 4 threat reports. Priority 93.3 of 100.kevransomwarepublic-exploitT1190T1133https://patchfirst.co/cve/CVE-2026-0300/CVE-2026-0300#kevWed, 06 May 2026 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2026-05-06. ENISA EUVD lists it as exploited. EPSS 41.7% (higher than 98.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 84.6 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2025-0111/CVE-2025-0111#kevThu, 20 Feb 2025 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2025-02-20. ENISA EUVD lists it as exploited. EPSS 2.0% (higher than 80.7% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1068 Exploitation for Privilege Escalation; T1005 Data from Local System. Priority 58.7 of 100.kevT1068T1005https://patchfirst.co/cve/CVE-2025-0108/CVE-2025-0108#kevTue, 18 Feb 2025 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2025-02-18. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1055 Process Injection; T1565.001 Stored Data Manipulation. Priority 69.4 of 100.kevpublic-exploitT1190T1055T1565.001https://patchfirst.co/cve/CVE-2025-0107/CVE-2025-0107Sat, 11 Jan 2025 00:00:00 GMTPalo Alto Networks · Cloud NGFW. Not in CISA KEV. EPSS 78.4% (higher than 99.58% of CVEs). CVSS 7.7 HIGH. Public exploit code exists. Priority 65.3 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-3393/CVE-2024-3393#kevMon, 30 Dec 2024 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2024-12-30. ENISA EUVD lists it as exploited. EPSS 29.1% (higher than 98.2% of CVEs). CVSS 7.5 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1499.004 Application or System Exploitation. Priority 62.9 of 100.kevT1190T1499.004https://patchfirst.co/cve/CVE-2024-0012/CVE-2024-0012#kevMon, 18 Nov 2024 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2024-11-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.8% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 79.9 of 100.kevransomwarepublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2024-9474/CVE-2024-9474#kevMon, 18 Nov 2024 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2024-11-18, known ransomware use. ENISA EUVD lists it as exploited. EPSS 93.8% (higher than 99.84% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 78.0 of 100.kevransomwarepublic-exploitT1078T1068https://patchfirst.co/cve/CVE-2024-9465/CVE-2024-9465#kevThu, 14 Nov 2024 00:00:00 GMTPalo Alto Networks · Expedition. In CISA KEV since 2024-11-14. ENISA EUVD lists it as exploited. EPSS 99.6% (higher than 99.95% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 69.4 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2024-9463/CVE-2024-9463#kevThu, 14 Nov 2024 00:00:00 GMTPalo Alto Networks · Expedition. In CISA KEV since 2024-11-14. ENISA EUVD lists it as exploited. EPSS 98.5% (higher than 99.92% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 68.2 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2024-5910/CVE-2024-5910#kevThu, 07 Nov 2024 00:00:00 GMTPalo Alto Networks · Expedition. In CISA KEV since 2024-11-07. ENISA EUVD lists it as exploited. EPSS 91.7% (higher than 99.81% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.8 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2024-9464/CVE-2024-9464Wed, 09 Oct 2024 00:00:00 GMTPalo Alto Networks · Expedition. Not in CISA KEV. EPSS 82.6% (higher than 99.67% of CVEs). CVSS 9.3 CRITICAL. Public exploit code exists. Priority 31.4 of 100.public-exploithttps://patchfirst.co/cve/CVE-2024-3400/CVE-2024-3400#kevFri, 12 Apr 2024 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2024-04-12, known ransomware use. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 3 threat reports. Priority 87.7 of 100.kevransomwarepublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2022-0028/CVE-2022-0028#kevMon, 22 Aug 2022 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2022-08-22. ENISA EUVD lists it as exploited. EPSS 2.7% (higher than 85.9% of CVEs). CVSS 8.6 HIGH. ATT&CK: T1190 Exploit Public-Facing Application; T1498 Network Denial of Service. Priority 61.2 of 100.kevT1190T1498https://patchfirst.co/cve/CVE-2017-15944/CVE-2017-15944#kevThu, 18 Aug 2022 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2022-08-18. ENISA EUVD lists it as exploited. EPSS 98.3% (higher than 99.92% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2020-2021/CVE-2020-2021#kevFri, 25 Mar 2022 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2022-03-25, known ransomware use. ENISA EUVD lists it as exploited. EPSS 4.4% (higher than 91.2% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 78.2 of 100.kevransomwarepublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2019-1579/CVE-2019-1579#kevMon, 10 Jan 2022 00:00:00 GMTPalo Alto Networks · PAN-OS. In CISA KEV since 2022-01-10, known ransomware use. ENISA EUVD lists it as exploited. EPSS 44.2% (higher than 98.8% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 78.4 of 100.kevransomwarepublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2020-2038/CVE-2020-2038Wed, 09 Sep 2020 00:00:00 GMTPalo Alto Networks · PAN-OS. Not in CISA KEV. EPSS 86.2% (higher than 99.73% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. Priority 31.4 of 100.public-exploithttps://patchfirst.co/cve/CVE-2020-2034/CVE-2020-2034Wed, 08 Jul 2020 00:00:00 GMTPalo Alto Networks · PAN-OS. Not in CISA KEV. EPSS 7.2% (higher than 94.3% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 65.9 of 100.public-exploit