Palo Alto Networks — Security Activity Report

PAN-OS, GlobalProtect, Prisma, Cortex (PSIRT advisories)

Generated Jul 22, 2026Cohort: 9 vendors with ≥10 CVE advisoriesMethodology ↗

CVE Disclosure Volume

Total all-time: 46 CVEs with Palo Alto Networks advisories. Source: NVD CVE records joined with vendor advisory publish dates.

Severity Composition

↑ +13.0 pp

65.2% of Palo Alto Networks's 46 CVEs are CRITICAL or HIGH severity. Industry median: 52.2%. Source: NVD CVSS v3.1.

CRITICAL 6 (13.0%)HIGH 24 (52.2%)MEDIUM 15 (32.6%)LOW 1 (2.2%)

CISA KEV Listings

↑ +3.4 pp

2 of 46 Palo Alto Networks CVEs in the last 3 years are on CISA's Known Exploited Vulnerabilities catalog (4.3%). Industry median: 1.0%.

Source: CISA Known Exploited Vulnerabilities catalog (current snapshot). KEV listing means CISA observed active in-the-wild exploitation.

Vendor Patch Velocity

↓ -7.5 days

Median time from CVE disclosure to Palo Alto Networks advisory: 7 days (p25 7 days – p75 7 days). Industry median: 15 days.

Sample size: 10 CVE→advisory pairs over the last 3 years. Source: vendor advisory published_at minus CVE published.

Top Recurring Weakness Classes

Most-frequently mapped CWEs across Palo Alto Networks's last 3 years of CVE disclosures. Source: NVD — CWE mapping per MITRE taxonomy.

CWE-295Improper Certificate Validation4 CVEs
CWE-754Improper Check for Unusual or Exceptional Conditions4 CVEs
CWE-787Out-of-bounds Write4 CVEs
CWE-78OS Command Injection3 CVEs
CWE-79Cross-site Scripting (XSS)3 CVEs

Recent Security Advisories

Latest advisories published by Palo Alto Networks, straight from the vendor's own feed. Severity labels are the vendor's — scales differ across vendors.

CVE-2026-0281Low
Jul 8, 2026
CVE-2026-0281 PAN-OS: Information Disclosure Vulnerability in Management Web Interface
CVE-2026-0281 vendor source ↗
CVE-2026-0277Medium
Jul 8, 2026
CVE-2026-0277 Prisma Access Agent: Improper Certificate Validation on iOS
CVE-2026-0277 vendor source ↗
CVE-2026-0279Low
Jul 8, 2026
CVE-2026-0279 PAN-OS: Multiple Cross-Site Scripting (XSS) Vulnerabilities
CVE-2026-0279 vendor source ↗
CVE-2026-0282Low
Jul 8, 2026
CVE-2026-0282 PAN-OS: File Deletion Vulnerability in Management Web Interface
CVE-2026-0282 vendor source ↗
CVE-2026-0286Medium
Jul 8, 2026
CVE-2026-0286 PAN-OS: Authenticated Command Injection in CLI
CVE-2026-0286 vendor source ↗
CVE-2026-0280Low
Jul 8, 2026
CVE-2026-0280 PAN-OS: IPv6 Firewall Policy Bypass
CVE-2026-0280 vendor source ↗
CVE-2026-0278Medium
Jul 8, 2026
CVE-2026-0278 Prisma Access Agent: Multiple DLP Policy Bypass Vulnerabilities on Windows
CVE-2026-0278 vendor source ↗
CVE-2026-0288High
Jul 8, 2026
CVE-2026-0288 PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent
CVE-2026-0288 vendor source ↗

Full advisory archive: /pulse/vendor-advisories →

Data sources & corrections

NVD National Vulnerability Database (nvd.nist.gov) — CVE records + CVSS v3.1 severity
MITRE cvelistV5 (github.com/CVEProject/cvelistV5) — CNA-published CVE timestamps
CISA Known Exploited Vulnerabilities catalog (cisa.gov/known-exploited-vulnerabilities-catalog)
Vendor security advisories (RHSA, USN, MSRC, GHSA, etc.) — published_at timestamps
MITRE CWE taxonomy (cwe.mitre.org) — weakness class mappings

Snapshot generated Jul 22, 2026. Industry medians refresh every 6 hours; raw vendor counts are queried live on each request.

Spot a factual error in this report?

Email support@echelongraph.io with the specific number you're disputing and a link to the authoritative source. We review every report and publish corrections on the methodology page.