CVE-2023-38046: PAN-OS: Read System Files and Resources During Configuration Commit

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-12 · updated 2026-06-17
Weakness: CWE-610

Description

A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated administrator with the privilege to commit a specifically created configuration to read local files and resources from the system.

Affected products

Palo Alto Networks PAN-OS: from 10.2.0 before 10.2.4; 11.0.0 (and their updates) — fixed in 10.2.4
Palo Alto Networks PAN-OS: from 11.0 before 11.0.1; from 10.2 before 10.2.4 — fixed in 11.0.1, 10.2.4

How to fix

Upgrade to a fixed version: Palo Alto Networks PAN-OS 10.2.4; Palo Alto Networks PAN-OS 11.0.1, 10.2.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-38046 or the next vulnerability affects your stack