Project

PAN-OS

Palo Alto Networks firewall operating system, described as using a master key for cryptographic key encryption and storing only SHA-256 salted password hashes.

Known aliases

PanOS
PAN-OS GlobalProtect
PAN-OS software

Current stories

securityConfirmed3 publishers

Palo Alto confirms exploitation of CVE-2026-0322, a PAN-OS management flaw that grants root

Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), a PAN-OS management RCE it says is under limited exploitation. CISA gave federal agencies until October 17; exploiting it takes a valid login and network access to the management interface.

Publishers:bleepingcomputer.com securityweek.com thehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 8%
Operator: Operator 74%
Investor: Investor 18%

Reality

Evidence72
Adoption: Insufficient
Hype gap−10
Incentives: Insufficient
Confidence75

leadershipOne report1 publisher

Palo Alto reports attempts to exploit a GlobalProtect VPN bypass on cookie-enabled firewalls

Palo Alto Networks rates the 7.8-score CVE-2026-0257 GlobalProtect bypass at highest urgency after limited exploit attempts. Exposure needs authentication override cookies plus a specific certificate setup, and the fix costs users one re-login.

Publishers:security.paloaltonetworks.com

Reality

Evidence55
Adoption: Insufficient
Hype gap−10
Incentives: Insufficient
Confidence60

buildOne report1 publisher

FortiOS blocks central NAT while a single policy still references a VIP

Moving an ASA or PAN-OS rulebase onto a FortiGate means picking the NAT model on an empty appliance, because the toggle that gives back one shared NAT table is gated on every VIP and IP pool reference in the policy set.

Publishers:dev.to

Reality

Evidence62
Adoption: Insufficient
Hype gap−5
Incentives30
Confidence58

securityOne report1 publisher

Sixteen Metasploit modules reduce this quarter's advisories to one-command checks

Rapid7 describes eleven of the sixteen additions, and eight of those are scanners rather than exploits. The unauthenticated file reads and SQL injections carry the real pressure this quarter, well ahead of the two Tenable modules.

Publishers:blog.rapid7.com

Reality

Evidence63
Adoption34
Hype gap+24
Incentives69
Confidence58

securityOne report1 publisher

Unit 42's Credential Brief: Hunt The Login That Succeeds Right After The Failures

TheHatman's claimed Entra haul and the FortiBleed spraying wave share one detectable seam: a successful authentication landing just behind a spike of failures.

Publishers:unit42.paloaltonetworks.com

Reality

Evidence46
Adoption58
Hype gap+12
Incentives78
Confidence44