{"id":"CVE-2026-0265","aliases":["EUVD-2026-30066","GHSA-qcp7-r34x-6gv6"],"status":"published","title":"PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled","description":"An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.\n\n\n\nThe risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.\n\nThe risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCloud NGFW and Prisma Access® are not impacted by this vulnerability.","severity":{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Red","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01053,"percentile":0.64799,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-347"],"published":"2026-05-13T17:38:33Z","modified":"2026-10-26T17:10:03Z","exploits":[{"source":"metasploit","id":"auxiliary/scanner/http/panos_cve_2026_0265","title":"PAN-OS GlobalProtect CAS CVE-2026-0265 Vulnerability Checker","type":"auxiliary","date":"2026-05-21","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/panos_cve_2026_0265"},{"source":"pocgithub","id":"BishopFox/CVE-2026-0265-check","title":"BishopFox/CVE-2026-0265-check","date":"2026-05-22","url":"https://github.com/BishopFox/CVE-2026-0265-check"},{"source":"pocgithub","id":"tstephens1080/palo-alto-cve-2026-0265-checker","title":"tstephens1080/palo-alto-cve-2026-0265-checker","date":"2026-05-17","url":"https://github.com/tstephens1080/palo-alto-cve-2026-0265-checker"}],"products":[{"vendor":"palo alto networks","product":"cloud ngfw"},{"vendor":"palo alto networks","product":"pan-os"},{"vendor":"palo alto networks","product":"prisma access"},{"vendor":"paloaltonetworks","product":"pan-os"},{"vendor":"siemens","product":"ruggedcom ape1808"},{"vendor":"siemens","product":"ruggedcom_ape1808_firmware"}],"references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0265","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-967325.html","tags":["Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0265"},{"url":"https://github.com/advisories/GHSA-qcp7-r34x-6gv6"}],"sources":{"cve":[{"id":"CVE-2026-0265","title":"PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled","description":"An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.\n\n\n\nThe risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.\n\nThe risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCloud NGFW and Prisma Access® are not impacted by this vulnerability.","status":"published","published":"2026-05-13T17:38:33.822Z","modified":"2026-10-15T01:11:33.202Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Red","level":"high","assessor":"cna"},{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","level":"medium","assessor":"cna"},{"version":"4.0","score":2.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","level":"low","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:20:13.587351Z"}],"euvd":[{"id":"EUVD-2026-30066","description":"An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.\n\n\n\nThe risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.\n\nThe risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCloud NGFW and Prisma Access® are not impacted by this vulnerability.","status":"published","published":"2026-05-13T17:38:33Z","modified":"2026-10-15T01:11:33Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Red","level":"high"}],"updated_at":"2026-11-02T17:27:06.951216Z"}],"ghsa":[{"id":"GHSA-qcp7-r34x-6gv6","title":"An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an...","description":"An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.\n\n\n\nThe risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.\n\nThe risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCloud NGFW and Prisma Access® are not impacted by this vulnerability.","status":"published","published":"2026-05-13T18:30:58Z","modified":"2026-07-14T18:31:45Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:09:27.635559Z"}],"nvd":[{"id":"CVE-2026-0265","description":"An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.\n\n\n\nThe risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.\n\nThe risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended  best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .\n\nThis issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).\n\nCloud NGFW and Prisma Access® are not impacted by this vulnerability.","status":"published","published":"2026-05-13T18:16:14.693Z","modified":"2026-10-26T17:10:03.27Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Red","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:12:19.020465Z"}]}}