palo-alto-cve-2026-0265-checker

Features Connects to every device in parallel (configurable worker count; default 8). Single SSH session per device, runs only two read-only show commands — no configuration changes. Handles HA-state prompts (e.g. user@host(active)>) and disables the PAN-OS pager so output isn't truncated. Color-coded summary table (red / yellow / green) with separate AFFECTED BY CVE, CAS, and STATUS columns. Works against both firewalls and Panorama (same CLI on both). Cross-platform: Windows / macOS / Linux. ANSI colors auto-enabled on Windows 10+. Graceful SSH exit — sends exit before closing so PAN-OS audit logs see a clean logout rather than a transport drop.

Requirements Python 3.8 or newer paramiko (pip install paramiko) A read-only admin account that exists on every device in your list (TACACS+, RADIUS, SAML, or local — anything works as long as the same credentials authenticate everywhere). SSH (TCP/22) reachability from wherever you run the script to each device's management interface.

Installation

Usage Open check_cve_2026_0265.py and edit the DEVICES list near the top with your own hostnames and management IPs: python DEVICES = [ ("fw1-prod-region1", "192.0.2.10"), ("fw2-prod-region1", "192.0.2.11"), ("panorama1", "198.51.100.10"), # ... ] Optionally change DEFAULT_USER to your standard read-only admin account name. Run the script: bash python check_cve_2026_0265.py Enter your SSH username and password when prompted. The same credentials are reused for every device.

Sample output

In a real terminal the STATUS column is color-coded: Status Color Meaning VULNERABLE bold red Affected version and CAS is configured — patch immediately NOT_EXPLOITABLE yellow Affected version, but CAS is not configured — patch on next maintenance window SAFE green Version is at or beyond the fixed hotfix for this CVE Error states (AUTH_FAIL, UNREACHABLE, PARSE_ERR) are listed in the error-detail block below the table.

How it works For each device, the script runs an interactive SSH session and issues two commands:

The first returns a line like sw-version: 11.1.4-h7. The second is empty if no CAS-based authentication profile is configured on the device. The script combines these two answers against the affected-version table from the published advisory.

A note on CAS detection: when a match filter has no hits, the device returns nothing other than the echoed command and the next prompt. The script accounts for the echoed command itself containing the keyword and only flags CAS as "configured" when the keyword appears more than once in the output.

Caveats This script only validates the CVE-2026-0265 attack path (CAS-based authentication). A device returning NOT_EXPLOITABLE is not exploitable through this CVE in its current configuration, but it's still running affected code and should be patched on a normal maintenance cadence. The CAS check looks for any cloud-authentication-service reference in the running config. It does not verify whether that profile is bound to a login interface (mgmt UI, Authentication Portal, GlobalProtect portal/gateway). A configured-but-unbound CAS profile is technically not exploitable either, but the script conservatively reports it as VULNERABLE. HA pairs share configuration when sync is healthy, but the script checks each peer independently so you can confirm both sides actually agree. This script does not log into the device using SSH keys or certificate-based auth — only password authentication is implemented. PRs welcome.

References Palo Alto Networks Security Advisory: CVE-2026-0265 Palo Alto Networks: Best practices for securing administrative access Cloud Identity Engine / Cloud Authentication Service overview

License MIT — see LICENSE.

Disclaimer This script is provided as-is for defensive security and operational use. It is not affiliated with or endorsed by Palo Alto Networks. Always confirm CVE applicability against the official vendor advisory before making patching decisions.