Is CVE-2026-0284 actively exploited?

No active exploitation of CVE-2026-0284 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-0284 be exploited remotely?

Yes. CVE-2026-0284 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-0284?

CVE-2026-0284 has a CVSS score of 9.9 (CRITICAL).

HOME VULNERABILITIESCVE-2026-0284

CRITICAL

CVE-2026-0284

CWE-74Published: July 9, 2026· Updated: Jul 13, 2026

9.9

CVSS v3.1

EPSS:0.50%probability of exploitation in 30 daysPercentile:39.2th

Official Description

An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data.

Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

NVD Source

Risk Analysis

This critical XML injection vulnerability in Palo Alto Networks PAN-OS LSVPN functionality allows an unauthenticated attacker to inject malicious XML content. This could lead to information disclosure or corruption of internal LSVPN satellite data. With a CVSS score of 9.9, this flaw poses a severe risk to the confidentiality and integrity of affected PAN-OS installations.

No public exploit is currently known for this vulnerability. It is remotely exploitable due to its network attack vector and low attack complexity.

Recommended Action

Users should apply the latest security updates for Palo Alto Networks PAN-OS. Ensure that LSVPN configurations are reviewed and hardened according to best practices.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-0284 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 9.9.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.