Status: UPDATED | Advisory ID: CVE-2026-0265
| CVE | CVE-2026-0265 |
| CVSS Score / Version | 8.1 (High) / CVSS v3.1 |
| Updated | 2026-09-24 |
| CVSS Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS Prose | attack vector is network; attack complexity is high; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high. |
| Affected products | Siemens RUGGEDCOM APE1808 Firmware and Palo Alto Networks PAN-OS |
| Classified as | CWE-347 (Improper Verification of Cryptographic Signature) |
| Exploitation prediction (EPSS) | 1.05% probability of exploitation in the next 30 days (63% percentile) -- FIRST.org's EPSS model. |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| Siemens | RUGGEDCOM APE1808 Firmware | ||
| Palo Alto Networks | PAN-OS |
| Subsystems | PLC/PAC/RTU |
| Sectors | Critical Manufacturing, Energy, Food and Agriculture, Multi-sector, Transportation Systems |
An authentication bypass vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to bypass authentication controls when Cloud Authentication Service (CAS) is enabled.
The risk is higher if CAS is enabled on the management interface and lower when any other login interfaces are used.
The risk of this issue is greatly reduced if you secure access to the management web interface by restricting access to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series).
Cloud NGFW and Prisma Access® are not impacted by this vulnerability.
Monitor Siemens's and Palo Alto Networks's web pages for any future patch releases. See vendor advisory link below.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2026-0265 |
| CVE | https://www.cve.org/CVERecord?id=CVE-2026-0265 |
| Vendor advisory | https://security.paloaltonetworks.com/CVE-2026-0265 |