PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-0258 Palo Alto Networks CVE debrief

A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition. Panorama, Cloud NGFW and Prisma Access are not impacted by these vulnerabilities.

Vendor
Palo Alto Networks
Product
Cloud NGFW
CVSS
MEDIUM 4.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-06-09
Advisory published
2026-05-13
Advisory updated
2026-06-09

Who should care

Users of Palo Alto Networks PAN-OS software should be aware of this vulnerability and take necessary precautions to mitigate the risk.

Technical summary

The vulnerability has a CVSS score of 4.8 and a severity of MEDIUM. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Amber.

Defensive priority

MEDIUM

Recommended defensive actions

  • Apply patches or updates provided by Palo Alto Networks to fix the vulnerability.
  • Restrict access to the affected systems and networks.

Evidence notes

The vendor of this product is likely Palo Alto Networks.

Official resources

CVE-2026-0258 was published on [2026-05-13T19:17:01.483Z].