A flaw in the PAN‑OS management web interface allows an unauthenticated attacker with network access to send crafted requests that delete files from the device’s temporary directory. This input‑validation weakness (CWE‑20) permits removal of non‑critical temporary files but does not directly compromise system files or data, limiting the impact primarily to loss of temporary data and minimal operational disruption.

The vulnerability affects Palo Alto Networks PA‑Series and VM‑Series firewalls, as well as Panorama (virtual and M‑Series). Affected releases include PAN‑OS 10.2.0 through 10.2.18, 11.1.0 through 11.1.15‑h*, 11.2.0 through 11.2.12, and 12.1.0 through 12.1.7‑h*; all should be upgraded to 12.1.8 or later, 11.2.13 or later, or 11.1.16 or later. Cloud NGFW and Prisma are not impacted.

The CVSS score is 1.2, indicating very low severity, and the vulnerability is not listed in CISA KEV. The EPSS score of < 1 % shows a very low likelihood of exploitation in the wild. Attackers need only network access to the management interface, and restricting management interface traffic to trusted internal IP addresses effectively mitigates the risk.