---
id: CVE-2026-0301
title: >-
  An information disclosure vulnerability in the URL Filtering feature of Palo
  Alto Networks PAN-OS® software enables an unauthenticated user with network
  access to obtain sensitive information.


  Panorama is not impacted by this vulnerabil…
summary: >-
  An information disclosure vulnerability in the URL Filtering feature of Palo
  Alto Networks PAN-OS® software enables an unauthenticated user with network
  access to obtain sensitive information.


  Panorama is not impacted by this vulnerabil…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-908
vendor: paloaltonetworks
product: cloud_ngfw
affected:
  - cloud_ngfw
  - prisma_access < 6.0.0
  - 'pan-os >= 10.2.0, < 10.2.8'
  - 'pan-os >= 11.1.0, < 11.1.16'
  - pan-os = 11.1.16
patched:
  - prisma_access 6.0.0
  - pan-os 11.1.16
published: '2026-08-13'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:18:35.480'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-0301'
references:
  - url: 'https://security.paloaltonetworks.com/CVE-2026-0301'
    label: psirt@paloaltonetworks.com
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-967325.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
  - score-dispute
epss: 0.00316
epssPercentile: 0.22815
ingestedAt: '2026-10-15T03:30:12.917Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-13T13:31:13.098717Z'
scores:
  nvd: 7.5
  cna: 1.7
---

## Overview

An information disclosure vulnerability in the URL Filtering feature of Palo Alto Networks PAN-OS® software enables an unauthenticated user with network access to obtain sensitive information.

Panorama is not impacted by this vulnerability.

## Affected

- `cloud_ngfw`
- `prisma_access < 6.0.0`
- `pan-os >= 10.2.0, < 10.2.8`
- `pan-os >= 11.1.0, < 11.1.16`
- `pan-os = 11.1.16`

## Remediation

Upgrade past the affected range:

- `prisma_access 6.0.0`
- `pan-os 11.1.16`