PatchSiren cyber security CVE debrief

CVE-2026-0258 Palo Alto Networks CVE debrief

A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition. Panorama, Cloud NGFW and Prisma Access are not impacted by these vulnerabilities.

Vendor: Palo Alto Networks
Product: Cloud NGFW
CVSS: HIGH 8.2
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-12
Original CVE updated: 2026-07-02
Advisory published: 2026-05-12
Advisory updated: 2026-07-02

Who should care

Users of Palo Alto Networks PAN-OS software should be aware of this vulnerability and take necessary precautions to mitigate the risk.

Technical summary

The vulnerability has a CVSS score of 4.8 and a severity of MEDIUM. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Amber.

Defensive priority

MEDIUM

Recommended defensive actions

Apply patches or updates provided by Palo Alto Networks to fix the vulnerability.
Restrict access to the affected systems and networks.

Evidence notes

The vendor of this product is likely Palo Alto Networks.

Sources and references

Verified primary and authoritative sources

CVE-2026-0258 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-0258

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-0258 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-0258

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://security.paloaltonetworks.com/CVE-2026-0258

[email protected]
Source reference
Unverified legacy reference

URL: https://cert-portal.siemens.com/productcert/html/ssa-967325.html

0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.