CVE-2026-0258
Critical
Description
A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended destinations or cause a denial of service (DoS) condition. Panorama, Cloud NGFW and Prisma® Access are not impacted by these vulnerabilities.
SeverityCritical
CVSS9.1
Exploit probability—
Product
Paloaltonetworks Pan-os
PublishedMay 13, 2026
First seenMay 13, 2026
Weakness typeCWE-918Server-side request forgery (SSRF)
How to fix
Update
- paloaltonetworks pan-os10.2.7, 10.2.10, 10.2.13, 10.2.16, 11.1.4, 11.1.6, 11.1.10, 11.1.13, 11.2.4, 11.2.7, 11.2.10, 12.1.4, 12.1.7 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| paloaltonetworks pan-os | v < 10.2.7, 10.2.8 ≤ v < 10.2.10, 10.2.11 ≤ v < 10.2.13, 10.2.14 ≤ v < 10.2.16, 10.2.7, 10.2.10, 10.2.13, 10.2.16, 10.2.17, 10.2.18, 11.1.0 ≤ v < 11.1.4, 11.1.5 ≤ v < 11.1.6, 11.1.8 ≤ v < 11.1.10, 11.1.11 ≤ v < 11.1.13, 11.1.4, 11.1.6, 11.1.7, 11.1.10, 11.1.13, 11.1.14, 11.2.0 ≤ v < 11.2.4, 11.2.5 ≤ v < 11.2.7, 11.2.8 ≤ v < 11.2.10, 11.2.4, 11.2.7, 11.2.10, 11.2.11, 12.1.0 ≤ v < 12.1.4, 12.1.5 ≤ v < 12.1.7, 12.1.4 | 10.2.7, 10.2.10, 10.2.13, 10.2.16, 11.1.4, 11.1.6, 11.1.10, 11.1.13, 11.2.4, 11.2.7, 11.2.10, 12.1.4, 12.1.7 |
| siemens ruggedcom_ape1808_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.