CVE-2026-0301

⚠️ high

Summary

An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability.

CVSS Score

7.5

High

EPSS Score

0.3

Exploit Probability

Published Date

2026-08-13

First Seen: 2026-08-14

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 67.8% of all 365,890 vulnerabilities in our database.

#117,965

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Aug 13, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Jan Breig

SSVC data provided by CISA

Last Modified 2026-08-28

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

CWE IDs (Weakness Types)

CWE-908

📦 Affected Products 6

Vendor	Product	Status	Affected Versions
paloaltonetworks	pan-os	Affected	> 10.2.0 < 10.2.8
paloaltonetworks	pan-os	Affected	> 11.1.0 < 11.1.16
paloaltonetworks	pan-os	Affected	v11.1.16
paloaltonetworks	prisma_access	Affected	< 6.0
paloaltonetworks	prisma_access	Affected	< 6.0.0
paloaltonetworks	cloud_ngfw	Affected	v-

🔗 References 1

https://security.paloaltonetworks.com/CVE-2026-0301

Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-0279	🔶 medium	6.1	0.3	Multiple cross site scripting vulnerabilities in the User-ID™ Authentication Portal (aka Captive Portal) service, Glob...	2026-07-09
CVE-2026-0280	⚠️ high	7.2	0.2	An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthentica...	2026-07-09
CVE-2026-0281	⚠️ high	7.1	0.2	An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with...	2026-07-09
CVE-2026-0282	🔶 medium	6.5	0.2	A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network a...	2026-07-09
CVE-2026-0283	⚠️ high	7.2	0.2	An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software a...	2026-07-09
CVE-2026-0284	⛔ critical	9.9	0.3	An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enab...	2026-07-09

These CVEs affect the same products