CVE-2026-0323

LowCVSS 1.1/10Last modified Nov 11, 2026

Description

A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.

Metrics

CVSS 4.0 1.1/10

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Amber

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-03245.9An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtec CVE-2026-03251.3An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated attacker CVE-2026-03261.7A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by c CVE-2026-03272.3A privilege escalation vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated, lower-pri CVE-2026-03282.7Authentication bypass vulnerabilities in the GlobalProtect™ portal and gateway of Palo Alto Networks PAN-OS® software enables an unauthentic CVE-2026-03294.6A buffer overflow vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to cause a de CVE-2026-03306.1A remote code execution (RCE) vulnerability in Palo Alto Networks PAN-OS® software on Panorama enables an authenticated administrator with n CVE-2026-03316.6An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network acces CVE-2026-03837.8A vulnerability in Brocade Fabric OS could allow an authenticated, local attacker with privileges to access the Bash shell to access insecur CVE-2026-03855.0Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability CVE-2026-03867.5Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.CVE-2026-03906.7Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locall