China Launches Cybersecurity Review of Palo Alto Networks Products

Security Checks for Critical Infrastructure

On August 8, 2026, the Cyberspace Administration of China (CAC) launched a cybersecurity review of Palo Alto Networks products sold in China.

The initiative is intended to protect national security and ensure the secure operation of critical information infrastructure. The review is based on China’s National Security Law, Cybersecurity Law, and Cybersecurity Review Measures.

The authorities have not cited any specific vulnerabilities, incidents, or technical concerns. They have also provided no timeline for publishing the findings.

No Specific Models or Versions Identified

The review broadly covers Palo Alto Networks products marketed in China. No specific models, software versions, appliances, or cloud services have been identified.

There are no reported CVEs, compromises, or exploited vulnerabilities associated with the proceedings. As a result, no technical severity has been assigned.

Palo Alto Networks says it maintains high standards across its global operations and that, at present, the review does not restrict product distribution or customer support in the region.

The Main Risk Is Commercial and Geopolitical

The most significant potential consequence would be regulatory: the products could be excluded from certain Chinese procurement processes or replaced with domestic technologies.

Palo Alto Networks does not publicly break out revenue generated in China, so the financial impact of any restrictions cannot be quantified.

The decision is part of China’s drive for technological self-reliance, which is increasingly linking cybersecurity with national security. In January, authorities had already asked Chinese companies to stop using security software from a list of U.S. and Israeli vendors.

Foreign vendors mentioned in this context include Fortinet, Check Point, and CrowdStrike. Huawei and H3C, meanwhile, promote firewalls and security platforms developed in China.

The Micron Precedent and What Customers Should Do

The most significant precedent is the review launched against Micron in 2023. After several weeks, the company’s products were deemed a risk to critical infrastructure, and sales were effectively restricted.

No updates, fixes, or specific remediation plans have been announced for Palo Alto Networks. Customers in the region can therefore continue following their standard operating procedures while monitoring official communications from the company and the CAC.

Organizations that rely on these products should nevertheless assess continuity, procurement, and replacement scenarios, as neither the review’s duration nor the conditions for its conclusion are currently known.