Vulnerability record/PUBLISHED/Published Nov 11, 2026 19:35:31 UTC

CVE-2026-0331

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network access to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. Panorama is not affected by this vulnerability.

Base score6.6/ 10

SeverityMediumCVSS 4.0

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Attack requirementsNoneAT

Privileges requiredNonePR

User interactionNoneUI

Vulnerable system confidentialityHighVC

Vulnerable system integrityNoneVI

Vulnerable system availabilityNoneVA

Subsequent system confidentialityNoneSC

Subsequent system integrityNoneSI

Subsequent system availabilityNoneSA

Exploit maturityUnprovenE

AutomatableNoAU

RecoveryUserR

Value densityDiffuseV

Response effortModerateRE

Provider urgencyAmberU

CVSS vector stringCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritypalo_alto

Last updatedNov 13, 2026 19:37:24 UTC

PublishedNov 11, 2026 19:35:31 UTC

ReservedNov 3, 2025 20:46:33 UTC

Credits

OpenAI
Rotem Bar (internal reporter)