CVE-2026-0259 Arbitrary File Read and Delete Vulnerability in Palo Alto Networks WildFire Appliance

CVE-2026-0259 is an arbitrary file read and delete vulnerability affecting Palo Alto Networks WildFire WF-500 and WF-500-B appliances. This vulnerability allows a low-privileged user to read sensitive information and delete arbitrary files on the affected appliances. The vulnerability impacts appliances running in the default non-FIPS configuration mode. Palo Alto Networks discovered this vulnerability internally. Customers using the WildFire Public cloud service are not affected. Exploitation of this vulnerability could lead to information disclosure and disruption of services provided by the WildFire appliance.

Attack Chain

1. An attacker gains low-privileged access to the WildFire WF-500 or WF-500-B appliance.
2. The attacker leverages the arbitrary file read vulnerability to access sensitive files on the system, such as configuration files or logs.
3. The attacker analyzes the contents of the files to gather information about the system and its configuration.
4. The attacker uses the arbitrary file delete vulnerability to delete critical system files.
5. Deletion of critical files leads to system instability and potential disruption of services.
6. The attacker may attempt to delete log files to cover their tracks.

Impact

Successful exploitation of CVE-2026-0259 can lead to the disclosure of sensitive information stored on the WildFire appliance. This information could include configuration details, internal network information, or user credentials. Additionally, the ability to delete arbitrary files can cause significant disruption to the WildFire appliance’s functionality, potentially impacting the organization’s ability to analyze and mitigate threats. Palo Alto Networks is not aware of any malicious exploitation of this issue.

Recommendation

• Upgrade WildFire WF-500 and WF-500-B appliances to a fixed version as specified in the Palo Alto Networks advisory to remediate CVE-2026-0259.
• For airgapped deployments, restrict access to WildFire 500 appliances to only trusted internal IP addresses as a workaround.
• Customers with a Threat Prevention subscription can enable Threat ID 510010 (Applications and Threats content version 9100-10044 and later) to block attacks targeting this vulnerability.
• Ensure SSL Decryption is enabled for Threat ID 510010 to function correctly, as mentioned in the advisory.