CVE-2026-0282: PAN-OS: File Deletion Vulnerability in Management Web Interface (Severity: LOW)
A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory.
The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
Other sources
A file deletion vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to delete files from a temporary directory.
The security risk posed by this issue is minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines (https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431).
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma® Access are not impacted by this vulnerability.
— Palo Alto Networks
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.1.8Fixed in 11.2.13Fixed in 11.1.16 - Upgrade
Upgrade
Palo Alto Networks PAN-OS 10.2to a version that resolves this vulnerability.Fixed in 11.1.16 - Upgrade
Upgrade
Palo Alto Networks PAN-OS 10.2to a version that resolves this vulnerability.Fixed in 11.2.13 - Upgrade
Upgrade
Palo Alto Networks PAN-OS 10.2to a version that resolves this vulnerability.Fixed in 12.1.8 - Upgrade
Upgrade
Palo Alto Networks PAN-OS 11.1to a version that resolves this vulnerability.Fixed in 11.1.16 - Upgrade
Upgrade
Palo Alto Networks PAN-OS 11.2to a version that resolves this vulnerability.Fixed in 11.2.13 - Upgrade
Upgrade
Palo Alto Networks PAN-OS 12.1to a version that resolves this vulnerability.Fixed in 12.1.8 - Configuration
Restrict access to the management web interface so it is reachable only from trusted internal IP addresses (apply Palo Alto Networks administrative access best-practice deployment guidelines).
Palo Alto Networks management web interface (PAN-OS) Restrict management interface access to trusted internal IP addresses = only trusted internal IP addresses
Event History
Frequently Asked Questions
What is the risk and severity of CVE-2026-0282?
CVE-2026-0282 has a medium severity score of 6.9, indicating a moderate risk level.
What is the nature of the vulnerability in CVE-2026-0282?
CVE-2026-0282 is a file deletion vulnerability found in the management web interface of Palo Alto Networks PAN-OS software.
Who can exploit the CVE-2026-0282 vulnerability?
An unauthenticated attacker with network access to the management web interface can exploit CVE-2026-0282.
How can organizations mitigate CVE-2026-0282?
Organizations can mitigate CVE-2026-0282 by ensuring that management web interface access is restricted and properly secured.
What impact does CVE-2026-0282 have on affected systems?
CVE-2026-0282 allows attackers to delete files from a temporary directory, potentially compromising the management interface's functionality.