CVE-2026-0301

Analyzed Analyzed - Analysis Complete

Information Disclosure in Palo Alto PAN-OS URL Filtering

Publication date: 2026-08-13

Last updated on: 2026-08-28

Assigner: Palo Alto Networks, Inc.

Description

An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information. Panorama is not impacted by this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-28

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-01

NVD

CVE-2026-0301

EUVD

EUVD-2026-57714

Affected Vendors & Products

Vendor	Product	Version / Range
paloaltonetworks	cloud_ngfw	*
paloaltonetworks	cloud_ngfw	*
paloaltonetworks	pan-os	From 10.2.0 (inc) to 10.2.8 (exc)
paloaltonetworks	pan-os	From 11.1.0 (inc) to 11.1.16 (exc)
paloaltonetworks	pan-os	11.1.16
paloaltonetworks	prisma_access	to 6.0.0 (exc)
paloaltonetworks	prisma_access	to 6.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

CVE-2026-0301 is an information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS software. It allows an unauthenticated attacker with network access to obtain sensitive information. The flaw specifically affects firewalls where URL filtering is enabled with customized response pages.

Detection Guidance

To detect this vulnerability, check if your PAN-OS firewall has URL filtering enabled with customized response pages. Review logs for unusual information disclosure attempts. No specific commands are provided in the resources, but monitoring network traffic for unauthorized data exfiltration may help.

Impact Analysis

An attacker could exploit this vulnerability to access sensitive data through the URL Filtering feature. This may include internal network details or other confidential information. The impact is limited to systems with customized response pages enabled.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR or HIPAA. Organizations may face legal or regulatory penalties if data breaches occur due to this flaw.

Mitigation Strategies

Upgrade to fixed versions: PAN-OS 11.1.16-h1 or later, PAN-OS 10.2.8 or later, or Prisma Access 10.2.10 or later. Alternatively, limit response page variables to predefined options to reduce exposure.

Hi! I’m here to help you understand CVE-2026-0301. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70