PaloAlto Networks PAN-OS 11.1

productDE

cpe:/o:paloaltonetworks:pan-os:11.1

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical11high5medium0low

updated 2026-10-28

vulnerabilities (21)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-0273US	high7.2	1.34% (71st)	Exploit	no fix	2026-06-10	—
CVE-2026-0286US	high7.2	1.67% (77th)	—	no fix	2026-07-09	—
CVE-2024-3382US	high7.5	0.92% (60th)	—	no fix	2024-04-10	—
CVE-2024-3385US	high7.5	0.90% (60th)	—	no fix	2024-04-10	—
CVE-2024-3384US	high7.5	0.89% (59th)	—	no fix	2024-04-10	—
CVE-2026-0288US	high7.5	0.83% (57th)	—	no fix	2026-07-08	—
CVE-2026-0309US	—	0.78% (56th)	—	no fix	2026-09-10	—
CVE-2026-0279US	medium6.1	0.75% (55th)	—	no fix	2026-07-09	—
CVE-2026-0310US	—	0.67% (52nd)	—	no fix	2026-09-10	—
CVE-2026-0287US	high7.5	0.62% (50th)	—	no fix	2026-07-09	—
CVE-2025-4619US	—	0.59% (48th)	—	no fix	2025-11-13	—
CVE-2026-0308US	—	0.51% (44th)	—	no fix	2026-09-10	—
CVE-2026-0284US	critical9.9	0.46% (40th)	—	no fix	2026-07-09	—
CVE-2026-0285US	medium4.9	0.43% (37th)	—	no fix	2026-07-09	—
CVE-2026-0283US	high7.2OT elevated	0.38% (31st)	—	no fix	2026-07-09	—
CVE-2026-0280US	high7.2	0.34% (27th)	—	no fix	2026-07-09	—
CVE-2026-0282US	medium6.5	0.29% (22nd)	—	no fix	2026-07-09	—
CVE-2026-0281US	high7.1	0.28% (21st)	—	no fix	2026-07-09	—
CVE-2026-0272US	high7.2OT elevated	0.26% (18th)	—	no fix	2026-06-10	—
CVE-2026-0269US	medium5.7	0.22% (13th)	—	no fix	2026-06-10	—
CVE-2026-0266US	medium4.8	0.14% (3rd)	—	no fix	2026-06-10	—

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation3 CVEs
CWE-754Improper Check for Unusual or Exceptional Conditions3 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')3 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-787Out-of-bounds Write2 CVEs
CWE-1286Improper Validation of Syntactic Correctness of Input1 CVEs
CWE-131Incorrect Calculation of Buffer Size1 CVEs
CWE-306Missing Authentication for Critical Function1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.