CVE-2026-0259 Palo Alto Networks CVE debrief

Who should care

Security teams and administrators responsible for Palo Alto Networks WildFire WF-500 and WF-500-B appliances should be aware of this vulnerability. They should assess their current configuration and take necessary actions to mitigate the risk. This includes reviewing and applying the software update, monitoring for suspicious activity, and implementing compensating controls if necessary.

Technical summary

The vulnerability is caused by an issue in the Palo Alto Networks WildFire Appliance (WF-500, WF-500-B) software. This issue enables users to read sensitive information and delete arbitrary files when the appliances are running in the default non-FIPS configuration mode. The software update is now available to customers that use the WildFire Appliance (WF-500, WF-500-B) for on-premise sandboxing. Customers using the WildFire Public cloud service are NOT impacted by this vulnerability. Security teams should assess their current configuration and take necessary actions to mitigate the risk, including reviewing and applying the software update, monitoring for suspicious activity, and implementing compensating controls if necessary. The vulnerability has a CVSS score of 5 and a severity of MEDIUM.

Defensive priority

Medium priority for security teams to review and apply the software update for WF-500 and WF-500-B appliances.

Recommended defensive actions

• Apply the software update provided by Palo Alto Networks for WF-500 and WF-500-B appliances.
• Review and assess the current configuration of WF-500 and WF-500-B appliances to ensure they are not in a vulnerable state.
• Monitor for any suspicious activity on WF-500 and WF-500-B appliances.
• Consider implementing compensating controls for WF-500 and WF-500-B appliances until the update can be applied.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-05-13T19:17:01.873Z and has not been modified since then. The NVD entry is currently Analyzed. This vulnerability affects WF-500 and WF-500-B appliances running in the default non-FIPS configuration mode. There is no information on exploitation or additional vendor guidance beyond the software update.

Official resources