CVE-2026-0310: Cloud NGFW All; +3 more affected products

Affected technology

Cloud NGFW · All
Palo Alto Networks

PAN-OS · 12.2.0 to before 12.2.3; status changes: 12.2.3 — unaffected, 12.1.0 to before 12.1.4-h10; status changes: 12.1.10 — unaffected, 12.1.7-h5 — unaffected, 12.1.4-h10 — unaffected, 11.2.0 to before 11.2.4-h21; status changes: 11.2.13-h2 — unaffected, 11.2.10-h14 — unaffected, 11.2.7-h20 — unaffected, 11.2.4-h21 — unaffected, 11.1.0 to before 11.1.4-h36; status changes: 11.1.16-h2 — unaffected, 11.1.13-h12 — unaffected, 11.1.10-h33 — unaffected, 11.1.7-h10 — unaffected, 11.1.6-h38 — unaffected, 11.1.4-h36 — unaffected, 10.2.0 to before 10.2.7-h37; status changes: 10.2.18-h10 — unaffected, 10.2.16-h10 — unaffected, 10.2.13-h24 — unaffected, 10.2.10-h40 — unaffected, 10.2.7-h37 — unaffected
Palo Alto Networks

Prisma Access · 11.2.0 to before 11.2.4-h21; status changes: 11.2.7-h20 — unaffected, 10.2.0 to before 10.2.7-h37; status changes: 10.2.10-h40 — unaffected
Palo Alto Networks

RUGGEDCOM APE1808 · 0 to before *
Siemens

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated attacker with network access to the management web or dataplane interface can cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on the PA-Series firewalls. Vendor/CNA’s CVSS 4.0 assessment (base score 7.2/10) rates confidentiality, integrity and availability impact as high.