CVE-2026-0280

HighCVSS 7.2/10Last modified Aug 11, 2026

Description

An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services.

Cloud NGFW and Panorama are not impacted by this vulnerability.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-131

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2026
Last modified
Aug 11, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-02817.1An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to thCVE-2026-02826.5A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the managemeCVE-2026-02837.2An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker wiCVE-2026-02849.9An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticateCVE-2026-02854.9A server-side request forgery (SSRF) vulnerability in Palo Alto Networks PAN-OS software enables an authenticated administrator with networkCVE-2026-02867.2A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to eCVE-2026-02877.5Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cCVE-2026-02887.5Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow anCVE-2026-02896.5A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended sCVE-2026-02905.5An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker toCVE-2026-02914.4An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that eCVE-2026-02926.0An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Windows enables a local administr
CVE-2026-0280: High severity, CVSS 7.2 | Vulnix