Is CVE-2026-0281 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-0281 being exploited in the wild.

How severe is CVE-2026-0281?

Informational severity, with a CVSS score of 2.1, published 9 July 2026.

Which products and versions are affected?

Palo Alto Networks Panorama All versions running affected PAN-OS releases.

Is there a fix for CVE-2026-0281?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-0281 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-0281?

Check whether you run Palo Alto Networks Panorama at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-0281: Palo Alto Networks PAN-OS information disclosure in management web interface

CVE-2026-0281 · Severity: info · CVSS 2.1 · Published 2026-07-09

An information disclosure vulnerability exists in the management interface of Palo Alto Networks firewalls and Panorama management servers. If an administrator clicks on a malicious link while their management session is active, an attacker could steal their session token. This could allow the attacker to gain unauthorized access to the device management console, potentially leading to configuration changes or further network compromise.

Technologies: Palo Alto Networks Panorama. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0281 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-0281 being exploited in the wild.
How severe is CVE-2026-0281?: Informational severity, with a CVSS score of 2.1, published 9 July 2026.
Which products and versions are affected?: Palo Alto Networks Panorama All versions running affected PAN-OS releases.
Is there a fix for CVE-2026-0281?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-0281 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-0281?: Check whether you run Palo Alto Networks Panorama at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An information disclosure vulnerability (CWE-524) exists in the PAN-OS management web interface due to improper handling of sensitive information in the cache. An unauthenticated attacker with network access to the management interface can obtain web session tokens, provided they can induce a legitimate user to interact with a malicious link (User Interaction: Active). This vulnerability affects PA-Series, VM-Series, and Panorama appliances. Successful exploitation allows for session hijacking. Palo Alto Networks has released patches in versions 12.1.8, 11.2.13, and 11.1.16; users on 10.2 must upgrade to a fixed higher branch. Mitigation includes restricting management interface access to trusted internal IP addresses.

Affected products

Palo Alto Networks PAN-OS 12.1 < 12.1.8, 11.2 < 11.2.13, 11.1 < 11.1.16, 10.2 All versions
Palo Alto Networks Panorama All versions running affected PAN-OS releases

Timeline

2026-07-08: disclosed: Discovered internally by Palo Alto Networks research teams.
2026-07-08: advisory: Initial publication of the security advisory.

References

https://security.paloaltonetworks.com/CVE-2026-0281

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.