CVE-2026-0280

1.7 lowEPSS 0.3%

Low (1.7) in paloaltonetworks pan-os. EPSS 0.3% chance of exploitation in the next 30 days.

An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services. Cloud NGFW and Panorama are not impacted by this vulnerability.

Severity

CVSS 4.0

1.7 low

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/AU:Y/V:D/RE:M/U:Amber

CVSS 3.1

7.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWE: CWE-131
Published: 2026-07-09
Modified: 2026-08-11
Record from: the NVD, synced 2026-10-19

Affected

paloaltonetworks:pan-os

References

https://security.paloaltonetworks.com/CVE-2026-0280
https://cert-portal.siemens.com/productcert/html/ssa-104023.html

Check your stack JSON