CVE-2026-0265

Published May 13, 2026

Last updated 2 months ago

Overview

Description
An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled. The risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used. The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
Source
psirt@paloaltonetworks.com
NVD status
Analyzed
Products
pan-os, ruggedcom_ape1808_firmware

Risk scores

CVSS 4.0

Type
Secondary
Base score
7.2
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red
Severity
HIGH

CVSS 3.1

Type
Primary
Base score
8.1
Impact score
5.9
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

psirt@paloaltonetworks.com
CWE-347

Social media

Hype score
Not currently trending
  1. 本日のセキュリティ速報(6/19)注目の脆弱性・インシデント ・🔴 Palo Alto Networks PAN-OS:認証回避の脆弱性(CVE-2026-0265、別途CVE-2026-0300も対策公表)で、管理画面の不正アクセスにつながる恐れがあり緊急度が

    @BrainDirection

    19 Jun 2026

    18 Impressions

    1 Retweet

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🛡️本日のセキュリティ速報(6/17) ・Palo Alto Networks PAN-OS:認証回避の脆弱性(CVE-2026-0265、別途CVE-2026- ・Check Point製品:認証バイパスの脆弱性(CVE-2026-50751)にJPCERT/CC・IPAが揃って注意 注目の脆弱性・イン

    @BrainDirection

    17 Jun 2026

    82 Impressions

    1 Retweet

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. ⚠️ Vulnerabilidades en productos Palo Alto ❗ CVE-2026-0265 ❗ CVE-2026-0263 ❗ CVE-2026-0257 ➡️ Más info: https://t.co/I8y6zYFcGw https://t.co/pRL81cMl80

    @CERTpy

    16 Jun 2026

    71 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🛡️本日のセキュリティ速報(6/15) ・Check Point製品:認証バイパスの脆弱性(CVE-2026-50751)でJPCERT/CC・IPAが注意喚起、 ・Palo Alto Networks製PAN-OS:認証回避の脆弱性(CVE-2026-0265、関連でCVE-2026 注目の脆弱性・イ

    @BrainDirection

    15 Jun 2026

    98 Impressions

    1 Retweet

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. 先に話題になってたCVE-2026-0265よりまCVE-2026-0257の方が構成条件的に脆弱な機器が多いと思うので心配。

    @poppo9494

    31 May 2026

    70 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. Top 5 Trending CVEs: 1 - CVE-2026-0257 2 - CVE-2026-48095 3 - CVE-2026-42826 4 - CVE-2026-39987 5 - CVE-2026-0265 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    30 May 2026

    119 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. 【PAN-OS CVE-2026-0265、JPCERT/CCが注意喚起】 JPCERT/CCは、Palo Alto Networks製PAN-OSの認証回避脆弱性 CVE-2026-0265 について注意喚起しました。 対象は、CAS認証プロファイルをログインインターフェースに割り当てている

    @01ra66it

    25 May 2026

    209 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. PAN-OS に CAS 有効環境の認証バイパス脆弱性 CVE-2026-0265(Urgency HIGHEST)が公開されました。 ・Panorama も影響対象(CVE-2026-0300 と修正版は共通) ・CAS を SAML / RADIUS に切替で暫定回避が可能 ・管理 IF のアクセス元

    @MyTechBlogJP

    24 May 2026

    90 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. 【PAN-OS認証回避脆弱性 CVE-2026-0265、JPCERT/CCが注意喚起】 JPCERT/CCは、Palo Alto Networks製PAN-OSの認証回避脆弱性 CVE-2026-0265 について注意喚起を公開しました。CASが有効で、CAS認証プロファイルがログインインタフェ

    @01ra66it

    23 May 2026

    171 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  10. 【CVE-2026-0265の大規模検出手法、Bishop Foxが解説】 Bishop Foxは、PAN-OSのCVE-2026-0265について、大規模に影響確認するための検出手法を公開しました。Cloud Authentication Serviceが接続された環境で、認証前のJWT署名回避

    @01ra66it

    23 May 2026

    146 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. ⚠️ Vulnerabilidades en productos Palo Alto ❗ CVE-2026-0265 ❗ CVE-2026-0264 ➡️ Más info: https://t.co/QyvDqgMywa https://t.co/0YyRcrsrPP

    @CERTpy

    21 May 2026

    124 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  12. Top 5 Trending CVEs: 1 - CVE-2026-42945 2 - CVE-2026-46333 3 - CVE-2026-0265 4 - CVE-2020-2033 5 - CVE-2026-33278 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    21 May 2026

    145 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  13. CVE-2026-0265: Authentication Bypass in Palo Alto Networks PAN-OS https://t.co/05obFJd1Kw Overview On May 13, 2026, Palo Alto Networks published a security advisory for CVE-2026-0265, a signature verification vulnerability that facilitates authentication bypass on PAN-OS, the

    @f1tym1

    15 May 2026

    46 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. Palo Alto Networks patches CVE-2026-0263 and CVE-2026-0265. Fixes for IKEv2 RCE and CAS bypass are now available. Update your PAN-OS firewalls immediately! #PaloAltoNetworks #PANOS #CyberSecurity #InfoSec #RCE #Firewall #VulnerabilityAlert #CVE https://t.co/xj7Ollvkgr https://t.

    @Daily_CyberSec

    14 May 2026

    1583 Impressions

    6 Retweets

    27 Likes

    2 Bookmarks

    2 Replies

    0 Quotes

Configurations