CVE-2026-0331: PAN-OS: Sensitive Information Disclosure Vulnerability
- Is it exploited?
Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of . If CISA adds it, this page shows it as known exploited.
- How likely is exploitation in the next 30 days?
Not yet scored. FIRST's EPSS model has no score for this record as of .
- How severe?
- 6.6 Medium
CVSS v4.0 base score, given by the CNA
- What should I do?
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. Full textSolution from the CVE record.
CISA has set no required action, because the vulnerability is not in KEV.
- Which versions are affected?
Affected
- All
- from 12.2.0 to before 12.2.4-h2
- from 12.1.0 to before 12.1.10-h4
- from 11.2.0 to before 11.2.16-h2
- from 12.1.0 to before 12.1.10-h4
- from 11.2.0 to before 11.2.7-h24
and 1 more in the table below
Unaffected from 12.2.4-h2; from 12.1.10-h4; from 12.1.7-h12; from 12.1.4-h14; from 11.2.16-h2; from 11.2.13-h5; and 6 more
Source: CISA KEV 2026.11.10, as of ; FIRST EPSS, as of ; CVE List, as of . About the data.
Description
PAN-OS: Sensitive Information Disclosure Vulnerability
An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network access to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. Panorama is not affected by this vulnerability.
Source: CVE List, as of . About the data.
What to do
Advisories and patches
Solution (from the CVE record)
VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. PAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h2 or later. PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h4 or later. 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h12 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h14 or later. PAN-OS 11.2 11.2.15 through 11.2.16-h* Upgrade to 11.2.16-h2 or later. 11.2.11 through 11.2.13-h* Upgrade to 11.2.13-h5 or 11.2.16-h2 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h18 or 11.2.16-h2 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h24 or 11.2.16-h2 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h24 or 11.2.16-h2 or later. PAN-OS 11.1 11.1.14 through 11.1.16-h* Upgrade to 11.1.16-h5 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h17 or 11.1.16-h5 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h37 or 11.1.16-h5 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h13 or 11.1.16-h5 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h41 or 11.1.16-h5 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h39 or 11.1.16-h5 or later. PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18-h14 or later. 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h13 or 10.2.18-h14 or later. 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h28 or 10.2.18-h14 or later. 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h43 or…
Workaround (from the CVE record)
No known workarounds exist for this issue.
This summary is based on the CVE record as of . Check the vendor's advisory before you act: affected versions and fixes can change.
Affected products and versions
Versions by product, as listed in the CVE record (3 products)
| Status | Versions |
|---|---|
| Affected | All |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | from 12.2.0 to before 12.2.4-h2 |
| Unaffected | from 12.2.4-h2 |
| Affected | from 12.1.0 to before 12.1.10-h4 |
| Unaffected | from 12.1.10-h4 |
| Unaffected | from 12.1.7-h12 |
| Unaffected | from 12.1.4-h14 |
| Affected | from 11.2.0 to before 11.2.16-h2 |
| Unaffected | from 11.2.16-h2 |
| Unaffected | from 11.2.13-h5 |
| Unaffected | from 11.2.10-h18 |
| Unaffected | from 11.2.7-h24 |
| Unaffected | from 11.2.4-h24 |
Versions not listed are: unaffected.
And 13 more version entries in the CVE record.
| Status | Versions |
|---|---|
| Affected | from 12.1.0 to before 12.1.10-h4 |
| Unaffected | from 12.1.10-h4 |
| Affected | from 11.2.0 to before 11.2.7-h24 |
| Unaffected | from 11.2.7-h24 |
| Affected | from 10.2.0 to before 10.2.10-h43 |
| Unaffected | from 10.2.10-h43 |
Versions not listed are: unaffected.
Versions the record lists as unaffected: 12.2.4-h2, 12.1.10-h4, 12.1.7-h12, 12.1.4-h14, 11.2.16-h2, 11.2.13-h5, 11.2.10-h18, 11.2.7-h24.
Source: CVE List, as of . About the data.
Weakness
CWE-200, 1 CAPEC
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Attack patterns (CAPEC)
- CAPEC-118: Collect and Analyze Information
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.
Timeline
| Date | Event |
|---|---|
| CVE record published |
Known exploited Palo Alto Networks vulnerabilities
- CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
- CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
- CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
- CVE-2025-0111: Palo Alto Networks PAN-OS File Read Vulnerability
- CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability