CVE-2026-0285: PAN-OS Server-Side Request Forgery (SSRF) – Palo Alto Networks

Technical summary

CVE-2026-0285 is a server-side request forgery vulnerability (CWE-918) in PAN-OS that allows an authenticated administrator to forge requests originating from the firewall to internal services. The vulnerability requires network access to the management web interface and high-privilege administrator credentials. The CVSS v3.1 score of 4.9 (MEDIUM) reflects the integrity impact and the privilege requirement—an attacker must already have admin access to the management plane. The vulnerability does not affect Panorama, Cloud NGFW, or Prisma Access platforms.

Business impact

This vulnerability primarily affects organizations running on-premises PAN-OS firewalls with relaxed management interface access controls. An insider threat or compromised admin account could abuse this flaw to probe or attack internal services behind the firewall, potentially leading to lateral movement, data exfiltration, or service disruption. Organizations with strong perimeter controls and restricted management access face lower practical risk. The fact that cloud and Panorama deployments are unaffected limits the blast radius for cloud-centric architectures.

Affected systems

Palo Alto Networks PAN-OS is affected across multiple versions. The vulnerability does not impact Panorama (centralized management), Cloud NGFW, or Prisma Access. Organizations running on-premises PAN-OS firewalls should verify their specific version against Palo Alto Networks' published advisory to determine patching eligibility. Consult the vendor advisory for the complete list of affected and remediated versions.

Exploitability

Exploitation requires an authenticated administrator account with access to the management web interface and network connectivity to that interface. There is no unauthenticated path to exploiting this vulnerability. The moderate CVSS score reflects both the privileged access requirement and the conditional nature of the threat. This is not a critical internet-facing vulnerability, but a lateral-movement risk for organizations where management access controls are weak or where insider threats are a concern.

Remediation

Apply security updates from Palo Alto Networks as specified in their advisory. Simultaneously, implement or enforce Palo Alto Networks' recommended best practice: restrict management interface access to only trusted internal IP addresses via firewall rules or network segmentation. This two-pronged approach—patching plus network isolation—significantly reduces the practical risk and should be prioritized in your remediation plan.

Patch guidance

Consult the Palo Alto Networks security advisory for affected version numbers and corresponding patches. Patches are available and should be applied according to your change management process. Verify the patch version against the official vendor advisory before deployment. Test patches in a non-production environment first, as management interface changes can affect firewall operability if not applied carefully.

Detection guidance

Monitor management interface access logs for unusual administrative activity, particularly authenticated requests that attempt to contact internal services or IP addresses not typically accessed via the management interface. Look for admin accounts making outbound requests to unexpected destinations. Review firewall logs for anomalies in request patterns following the advisory publication date. Network segmentation and access controls reduce the visibility of this activity, so focus on administrative user behavior analytics and management interface audit logs.

Why prioritize this

Although classified as MEDIUM severity, this vulnerability warrants prompt attention because it enables lateral movement from an authenticated management position. Prioritize if: (1) your management interface is exposed to a broad set of administrators or untrusted networks, (2) you lack strong internal network segmentation, or (3) insider threats are a concern in your environment. Organizations with properly isolated management access can safely schedule this in a standard patch cycle but should not deprioritize indefinitely. The fact that it's not yet in CISA's Known Exploited Vulnerabilities catalog suggests active exploitation is not widespread, reducing time-sensitive pressure.

Risk score, explained

The CVSS 3.1 score of 4.9 reflects a MEDIUM severity driven by the integrity impact (the ability to make unauthorized requests) offset by the high privilege requirement (admin access) and lack of user interaction. The attack vector is network (the interface is reachable over the network), but complexity is low and scope is unchanged (the attacker operates within the firewall's security context). The score appropriately captures that this is a serious insider or compromised-credential risk, not a mass-exploitation scenario.

Frequently asked questions