PAN-OS: Insufficient Session Expiration Vulnerability in the Web Interface
- Severity
- High8.8CVSS 3.1, High
- EPSS
- 0.50%
- Published
- 14 Feb 2024
- Updated
- 17 Jun 2026
Description
Title, description and vendor guidance are quoted from the source records.
Web sessions in the management interface in Palo Alto Networks PAN-OS software do not expire in certain situations, making it susceptible to unauthorized access.
Weakness: CWE-613
Known exploited
Not listed in CISA KEV as of the last check.
Exploit prediction
0.50% probability of exploitation in the next 30 days (percentile 41%).
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
What the source states, per branch
Versions matched by Patcharo
Palo Alto Networks PAN-OSSource: Palo Alto Networks (CVE record)
| Branch | Affected | Fixed in |
|---|---|---|
| 11.0 | >= 11.0.0, < 11.0.2 | 11.0.2 |
| 10.2 | >= 10.2.0, < 10.2.5 | 10.2.5 |
| 10.1 | >= 10.1.0, < 10.1.10-h1 >= 10.1.0, < 10.1.11 | 10.1.10-h1 10.1.11 |
| 10.0 | >= 10.0.0, < 10.0.12-h1 >= 10.0.0, < 10.0.13 | 10.0.12-h1 10.0.13 |
| 9.1 | >= 9.1.0, < 9.1.17 | 9.1.17 |
| 9.0 | >= 9.0.0, < 9.0.17-h2 >= 9.0.0, < 9.0.18 | 9.0.17-h2 9.0.18 |
Versions not listed are stated unaffected by the vendor.
Workaround / Vendor remediation
Workaround · PAN-OS
Ensure that inactivity-based screen locks are enforced on endpoints with access to the PAN-OS web interface.
Vendor remediation · PAN-OS
This issue is fixed in PAN-OS 9.0.17-h2, PAN-OS 9.1.17, PAN-OS 10.0.12-h1, PAN-OS 10.1.10-h1, PAN-OS 10.2.5, PAN-OS 11.0.2, and all later PAN-OS versions.
References
Provenance
Every fact on this page comes from the sources below. Nothing is written by an AI.
- Palo Alto Networks (CVE record)
- Palo Alto Networks (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
- NVD
- NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
- FIRST EPSS
- FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0
Last verified: 28 Sept 2026, 02:31 UTC