CVE-2026-0244: Prisma SD-WAN: Improper Certificate Validation Vulnerability

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-13 · updated 2026-10-26
Weakness: CWE-295

Description

An improper certificate validation vulnerability in the Palo Alto Networks Prisma SD-WAN ION enables man-in-the-middle (MitM) attacker to impersonate the controller.

Affected products

Palo Alto Networks Prisma SD-WAN ION: from 6.3.1 before 6.3.6; from 6.4.1 before 6.4.3; from 6.5.1 before 6.5.3; 6.3.6, 6.3.6-b6, 6.3.6-b9, 6.4.3, 6.4.3-b6, 6.4.3-b8 (+4) — fixed in 6.3.6, 6.4.3, 6.5.3
Palo Alto Networks Prisma SD-WAN ION: from 6.5.0 before 6.5.3-b15; from 6.4.0 before 6.4.3-b8; from 6.3.0 before 6.3.6-b10 — fixed in 6.5.3-b15, 6.4.3-b8, 6.3.6-b10

How to fix

Upgrade to a fixed version: Palo Alto Networks Prisma SD-WAN ION 6.3.6, 6.4.3, 6.5.3; Palo Alto Networks Prisma SD-WAN ION 6.5.3-b15, 6.4.3-b8, 6.3.6-b10. Check the vendor advisory for mitigations.

References

https://security.paloaltonetworks.com/CVE-2026-0244

Get alerted when CVE-2026-0244 or the next vulnerability affects your stack