1.0 Introduction
Recently, Palo Alto Networks has released security updates to address multiple vulnerabilities in PAN-OS, Prisma Access and the GlobalProtect app, covering CVE-2026-0314 to CVE-2026-0322.
2.0 Impact
Successful exploitation of these vulnerabilities may allow a remote attacker to trigger denial of service, remote code execution, elevation of privilege, spoofing, cross-site scripting and security restriction bypass on the targeted system. CVE-2026-0322 enables an authenticated attacker with network access to the management interface to execute arbitrary code with root privileges on the firewall. The company said the risk is highest when the management interface can be reached from external IP addresses on the internet.
3.0 Affected Products
- PAN-OS 10.2, versions earlier than 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11 or 10.2.18-h12
- PAN-OS 11.1 (including Panorama), versions earlier than 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15 or 11.1.16-h3
- PAN-OS 11.2 (including Panorama), versions earlier than 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.15 (Panorama) or 11.2.16
- PAN-OS 12.1 (including Panorama), versions earlier than 12.1.4-h12, 12.1.7-h8 or 12.1.10-h2
- PAN-OS 12.2 (including Panorama), versions earlier than 12.2.4
- Prisma Access 10.2 earlier than 10.2.10-h41, 11.2 earlier than 11.2.7-h21, and 12.1 earlier than 12.1.7-h8
- GlobalProtect App 6.0 earlier than 6.0.15 (Windows)
- GlobalProtect App 6.2 earlier than 6.2.8-h15 (Windows and macOS)
- GlobalProtect App 6.3 earlier than 6.3.3-h16 (Windows and macOS)
4.0 Recommendations
CyberSecurity Malaysia encourages users and administrators to review the following Palo Alto Networks security advisories and apply the necessary updates. Users are advised to upgrade to the fixed versions listed in each advisory. Palo Alto Networks recommends restricting management interface access to trusted internal IP addresses only, for example by allowing access only from a jump box. Administrators should also review management-interface authentication and access logs for unusual administrative activity.
Kindly refer to the following URL:
- https://security.paloaltonetworks.com/CVE-2026-0314
- https://security.paloaltonetworks.com/CVE-2026-0315
- https://security.paloaltonetworks.com/CVE-2026-0316
- https://security.paloaltonetworks.com/CVE-2026-0317
- https://security.paloaltonetworks.com/CVE-2026-0318
- https://security.paloaltonetworks.com/CVE-2026-0319
- https://security.paloaltonetworks.com/CVE-2026-0320
- https://security.paloaltonetworks.com/CVE-2026-0321
- https://security.paloaltonetworks.com/CVE-2026-0322
Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 08:30 -17:30 MYT|
Web: https://www.cybersecurity.my
5.0 References
- https://security.paloaltonetworks.com/
- https://security.paloaltonetworks.com/CVE-2026-0314
- https://security.paloaltonetworks.com/CVE-2026-0315
- https://security.paloaltonetworks.com/CVE-2026-0316
- https://security.paloaltonetworks.com/CVE-2026-0317
- https://security.paloaltonetworks.com/CVE-2026-0318
- https://security.paloaltonetworks.com/CVE-2026-0319
- https://security.paloaltonetworks.com/CVE-2026-0320
- https://security.paloaltonetworks.com/CVE-2026-0321
- https://security.paloaltonetworks.com/CVE-2026-0322