Advisory severityMedium6.3Vendor: LowPalo Alto Networks

Medium [CVE-2026-0301] PAN-OS: Information Disclosure Vulnerability in URL Filtering

This medium-severity Palo Alto Networks advisory covers CVE-2026-0301 affecting Cloud NGFW, PAN-OS, Prisma Access.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-0301 Source published Aug 12, 2026

VulniPulse record published Aug 12, 2026Record updated Sep 17, 2026

CVE-2026-0301

Affected products & platforms

Palo Alto NetworksPAN-OSFirewallPrisma AccessCloud NGFWPAN-OS / Panorama

Open source advisory

Android app · Google Play

Monitor future Palo Alto Networks CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

CVE-2026-0301 PAN-OS: Information Disclosure Vulnerability in URL Filtering

Affected products named by the advisory: Cloud NGFW; Prisma Access.

Affected versions

Cloud NGFW All
PAN-OS < 11.1.16-h1
PAN-OS < 10.2.8
Prisma Access < 10.2.10

Official advisory · high-confidence parse· fetched 23 days ago·verify at source

Fixed versions

PAN-OS >= 11.1.16-h1
PAN-OS >= 10.2.8
Prisma Access >= 10.2.10

Official advisory · high-confidence parse· fetched 23 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

PAN-OS 11.1 11.1.0 through 11.1.16-h* Upgrade to 11.1.16-h1 or later.
PAN-OS 10.2 10.2.0 through 10.2.* Upgrade to 10.2.8 or 11.1.16-h1 or later.
All olderunsupportedPAN-OS versions Upgrade to a supported fixed version.Prisma Access 12.112.1.2 through 12.1.*No action needed.Prisma Access 11.211.2.0 through 11.2*No action needed.

Temporary workarounds

Customers can mitigate this issue by limiting the Response Page Variables on their response page to only those in the Predefined URL Filtering Response Pages.
The variables that are included in our predefined response pages (user, url, category, pan_form) are not impacted by this vulnerability.

Official advisory · high-confidence parse· fetched 23 days ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Palo Alto Networks Security Advisoriesofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://security.paloaltonetworks.com/rss.xml; this link opens the Palo Alto Networks advisory index instead of the raw feed document.
Palo Alto Networks
Official vendor advisoryofficial
Official advisory page fetched and parsed; accepted detail fields are attributed to this page.
Palo Alto Networks
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-0301NVD CVE.org MITRE

Official resources

PAN-OS / Panorama upgrade guide (target: 11.1.16-h1 / 10.2.8 / 10.2.10)
Official documentation
This advisory names 11.1.16-h1 / 10.2.8 / 10.2.10 as the first fixed releases — official upgrade documentation for PAN-OS firewalls and Panorama.
Prisma Access / Prisma documentation
Official documentation
Official Prisma product documentation for the affected component.
Palo Alto Networks Security Advisories portal
Official documentation
Canonical advisory portal — check here for the latest revision of this advisory and affected-version updates.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.