CVE-2026-0282: PAN-OS Unauthenticated File Deletion Vulnerability

Technical summary

CVE-2026-0282 is an unauthenticated file deletion vulnerability in PAN-OS affecting PA-Series, VM-Series firewalls, and Panorama (virtual and M-Series). The vulnerability resides in the management web interface and allows network-accessible attackers to delete files in a temporary directory. The CVSS 3.1 score is 6.5 (MEDIUM), reflecting network-based attack vector, low complexity, and no required privileges, with limited impact (file deletion only, no confidentiality loss). The vulnerability stems from improper input validation (CWE-20).

Business impact

File deletion from temporary directories could disrupt operations or degrade firewall performance if critical temporary data is removed during processing. However, because temporary files are typically non-persistent and regenerated, the direct business impact is generally contained unless deletion coincides with critical logging, configuration staging, or session data. Organizations relying on temporary file integrity for compliance or forensic purposes may face secondary effects. The impact is substantially mitigated if management interfaces are restricted to trusted networks per vendor guidance.

Affected systems

PA-Series and VM-Series firewalls running PAN-OS are vulnerable. Panorama deployments (both virtual and M-Series appliances) are also affected. Cloud NGFW and Prisma Access are explicitly not vulnerable. Any organization exposing PAN-OS management interfaces to untrusted networks, even air-gapped, faces potential risk if an attacker gains network access to that interface.

Exploitability

Exploitation requires only network access to the management web interface; no authentication is needed. Attack complexity is low and can be executed without user interaction, making it straightforward for an attacker with network visibility to the management plane. However, in properly segmented networks where management access is restricted to internal trusted IPs (per vendor best practices), the practical exploitability is severely constrained because the attacker must first reach the management interface—typically a protected administrative plane.

Remediation

Consult Palo Alto Networks security advisories for patch availability and version numbers specific to your PAN-OS deployment. In parallel, immediately audit management interface access controls: restrict inbound connections to the management web interface to known, trusted internal IP addresses only. Implement network segmentation and firewall rules to prevent unauthorized access to the management plane. Consider disabling remote management access if not operationally required.

Patch guidance

Verify the availability of patched PAN-OS versions from Palo Alto Networks' official security advisories and update channels. Test patches in a non-production environment before deployment. Prioritize systems where management interfaces are currently exposed to broader networks. Coordinate patching with your change management process to minimize disruption, as management interface reboots may be required.

Detection guidance

Monitor management interface logs for unusual file deletion attempts, particularly targeting temporary directories (/tmp, %temp%, or platform-specific locations). Look for unauthenticated HTTP requests to management endpoints performing file operations. Network intrusion detection systems should flag unexpected traffic to management ports from external sources. Consider deploying a Web Application Firewall (WAF) in front of management interfaces to detect and block suspicious file deletion requests. Endpoint Detection and Response (EDR) tools on adjacent systems can flag anomalous processes attempting to interact with the firewall's management interface.

Why prioritize this

This vulnerability warrants prompt but not emergency attention. The CVSS 6.5 score reflects moderate severity, and it is not yet in active exploitation (not on the KEV catalog). However, prioritization depends on your network design: if management interfaces are exposed to untrusted network segments or internet-accessible, this should be addressed urgently. Organizations adhering to Palo Alto's recommended best practices—restricting management access to internal trusted IPs—face substantially lower risk and can treat this as part of routine patch cycles. The lack of confidentiality impact and the ease of network isolation distinguish this from critical vulnerabilities.

Risk score, explained

CVSS 3.1 assigns 6.5 (MEDIUM) due to the combination of network-based attack surface (AV:N), no authentication required (PR:N), and no user interaction (UI:N). However, the integrity and availability impacts are limited to file deletion in a temporary directory, not system compromise or credential theft. The score assumes the management interface is network-accessible; in properly segmented environments, real-world risk is substantially lower than the base CVSS suggests.

Frequently asked questions