Updated just now · 98 advisories
Remotely exploitable — could allow unauthorized configuration changes — no credentials needed
Remotely exploitable — could allow full system takeover — no credentials needed
Remotely exploitable — could expose sensitive process data
Remotely exploitable — could cause loss of control or data exposure — no credentials needed
Exploitable from adjacent network — could cause loss of control or denial of service
Requires local access — could allow full system takeover
This is an advance notification only; no vulnerabilities have been disclosed yet. On October 21, 2026, Cisco will publish security advisories affecting routers, security appliances, and collaboration products. Specific impact cannot be assessed until the actual vulnerabilities are disclosed.
A local attacker with low privileges on a Windows machine running GlobalProtect can crash the VPN client, interrupting secure access to your network and potentially disrupting remote work or field operations until the service is restarted.
A local user on macOS could gain administrative control of their machine and potentially compromise any VPN connections or sensitive data the organization relies on through that endpoint. This could enable lateral movement to network resources if the compromised machine is used to access critical infrastructure or control systems.
A malicious administrator could inject malicious JavaScript into the firewall's web management interface, potentially compromising other administrators' sessions or stealing their credentials when they log in.
An authenticated read-only administrator could crash the PAN-OS management interface with a crafted API request, temporarily disrupting access to firewall configuration and monitoring but not affecting active traffic forwarding.
An attacker could crash your Panorama management appliance, forcing it into maintenance mode and preventing you from managing your Palo Alto firewalls across your network until the system is recovered.
An authenticated user can hijack another user's GlobalProtect remote access session, allowing them to access network resources and systems using a compromised identity. This could enable lateral movement within your network and unauthorized access to sensitive infrastructure.
An authenticated admin with access to the management interface can execute arbitrary commands as root on the firewall, potentially disrupting network traffic filtering, exfiltrating configuration data, or altering security policies. This affects all PA-Series, VM-Series firewalls and Panorama.
An unauthenticated attacker can send malicious network packets through your firewall to trigger a denial of service, forcing the device into maintenance mode and blocking all network traffic until manual intervention.
An authenticated attacker who can reach your firewall's management interface could run commands with root-level access, potentially disrupting network traffic filtering, modifying security policies, or causing the firewall to stop functioning.
An attacker with network access to a 1732E ArmorBlock could execute arbitrary code on the device, potentially allowing them to intercept, modify, or disable encrypted communications between control systems and field devices, disrupting plant operations.
Requires local access — could allow unauthorized configuration changes
Requires local access — could expose sensitive process data
Remotely exploitable — could allow full system takeover
Remotely exploitable — could cause loss of control or denial of service — no credentials needed
An attacker could execute arbitrary code on a Windows workstation or server running Remote Desktop Client by sending a malicious network packet, potentially gaining full control of the machine and any systems it can access on your network.
An attacker could execute arbitrary code on a Windows system running Remote Desktop Client by sending a specially crafted RDP message, potentially allowing them to run commands, access sensitive data, or disrupt the system.
An attacker could execute commands on a Windows system running Remote Desktop Services without authentication, potentially allowing them to control the machine, access sensitive data, or disrupt critical operations in facilities that rely on Windows servers for process control or SCADA integration.
An attacker could execute arbitrary code on an operator workstation or server running Remote Desktop Client, potentially compromising the system and any connected SCADA/HMI systems or networks it can access.
An attacker with local access to a Windows system could read sensitive kernel memory that should be restricted, potentially exposing credentials or system configuration details. This is a local information disclosure only—no remote access or system compromise.