Attack Chain

1. Initial Access: An attacker gains authenticated access to the Palo Alto Networks PAN-OS management web interface, likely through stolen credentials (T1078) or a prior compromise.
2. Vulnerability Exploitation: The authenticated administrator crafts a malicious request leveraging the SSRF vulnerability (CVE-2026-0285, CWE-918) within the PAN-OS management web interface.
3. Firewall-Initiated Request: The vulnerable PAN-OS firewall is tricked into initiating an arbitrary HTTP/S request from its own network context to a target specified by the attacker.
4. Internal Network Access: The firewall, acting as an unwitting proxy, makes the unauthorized request to an internal service or host that is typically not directly reachable by the attacker's client.
5. Information Disclosure/Service Interaction: The firewall processes the response from the internal service and potentially relays sensitive information or the results of service interaction back to the authenticated administrator via the management interface.
6. Lateral Movement/Reconnaissance: The attacker uses the disclosed information or the ability to interact with internal services to conduct further reconnaissance, identify vulnerable internal systems, or bypass network segmentation, leading to deeper network compromise.

Impact

Successful exploitation of CVE-2026-0285 could enable an authenticated administrator to bypass network segmentation controls, conduct internal network reconnaissance, or interact with sensitive internal services that would otherwise be inaccessible. While no malicious exploitation has been reported, this could lead to unauthorized information disclosure from internal systems, expose vulnerable internal services, or facilitate lateral movement within an organization's network. The risk of impact is significantly higher for organizations that do not adhere to best practices by exposing their PAN-OS management interfaces to untrusted networks or the internet.

Recommendation

• Immediately patch CVE-2026-0285 by upgrading all affected PAN-OS instances to the recommended fixed versions listed in the advisory, such as PAN-OS 12.1.8+, 11.2.13+, 11.1.16+, or 10.2.18-h8+.
• Restrict management interface access to only trusted internal IP addresses, ensuring that external or untrusted networks cannot reach the PAN-OS management interface, as noted in the Recommendation section.
• For customers with a Threat Prevention subscription, enable Threat ID 510030 by updating to Applications and Threats content version 9122-10145 or later and ensure SSL Decryption is enabled for inbound traffic to management services.
• Review network configurations to confirm management interfaces are isolated and follow Palo Alto Networks' best practice deployment guidelines for securing administrative access.