Palo Alto security advisories, June 2026

Every Palo Alto Networks security advisory published in June 2026, from Palo Alto Networks Security Advisories, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 25
Critical: 1
High: 9
In CISA KEV: 1
CVEs: 284

Palo Alto advisories published in June 2026

Jun 13, 2026
High [CVE-2026-0249] GlobalProtect App: Certificate Validation Bypass Vulnerabilities
High7.6
Jun 13, 2026
High [CVE-2026-0250] GlobalProtect App: Buffer Overflow Vulnerability during connection to Portal or Gateway
High7.7
Jun 12, 2026
Medium [CVE-2026-45169] Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a…
Medium4.0
Jun 12, 2026
Medium [CVE-2026-45170] Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS…
Medium4.0
Jun 11, 2026
High [CVE-2026-0273] PAN-OS: Authenticated Admin Command Injection Vulnerability via CLI or Web UI
High8.6
Jun 11, 2026
Medium [CVE-2026-45174] Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5
Medium4.0
Jun 11, 2026
Medium [CVE-2026-45173] Idira Identity Browser Extension (Chrome, Firefox, and Edge builds) versions prior to 26.8.1 exhibit an origin validation flaw…
Medium4.0
Jun 11, 2026
Medium [CVE-2026-45172] Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5…
Medium4.0
Jun 11, 2026
Medium [CVE-2026-45171] Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions…
Medium4.0
Jun 11, 2026
Medium [CVE-2026-45175] Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within internal agent validation…
Medium4.0
Jun 11, 2026
Medium [CVE-2026-45178] Idira Secrets Manager Self-Hosted versions 13.8.0 and lower exhibit improper access control within internal cluster endpoints
Medium4.0
Jun 11, 2026
Medium [CVE-2026-45177] Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication…
Medium4.0
Jun 11, 2026
Medium [CVE-2026-45176] Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent…
Medium4.0
Jun 10, 2026
Critical [CVE-2026-0274] Cortex XSOAR: Improper Validation of Credentials in CommvaultSecurityIQ integration
Critical9.3
Jun 10, 2026
High [CVE-2026-0270] Cortex XSOAR: Path Traversal Vulnerability
High7.5
Jun 10, 2026
High [CVE-2026-0271] Prisma Access Agent: Local Privilege Escalation by Authorized Users
High8.5
Jun 10, 2026
High [CVE-2026-0272] PAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI)
High8.5
Jun 10, 2026
High [CVE-2026-10000 +243] PAN-SA-2026-0008 Chromium: Monthly Vulnerability Update (June 2026)
High
Jun 10, 2026
Medium [CVE-2026-0269] PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing
Medium6.9
Jun 10, 2026
Medium [CVE-2026-0267] GlobalProtect App: Information Exposure Vulnerability on macOS
Medium6.9
Jun 10, 2026
Medium [CVE-2026-0266] PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
Medium4.8
Jun 10, 2026
Medium [CVE-2026-0268] Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux
Medium6.9
Jun 10, 2026
Advisory [CVE-2025-61984 +16] PAN-SA-2026-0009 Informational Bulletin: Impact assessment of OSS CVEs in Prisma SD-WAN ION
Unrated
Jun 3, 2026
High [CVE-2026-0257] PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
High7.8PoC reportedCISA KEV
Jun 2, 2026
High [CVE-2026-0251] GlobalProtect App: Local Privilege Escalation Vulnerabilities
High8.5

Get an email when Palo Alto publishes the next one.

See Palo Alto's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Palo Alto

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.