WildFire 11.1/11.2 WF-500 and WF-500-B
Palo Alto Networks Inc. - FIPS 140 #5354
The Palo Alto Networks, Inc. WildFire 11.1.3/11.2.5 WF-500 and WF-500-B module identifies unknown malware, zero-day exploits, and Advanced Persistent Threats (APTs) through dynamic analysis, and automatically disseminates protection in near real-time to help security teams meet the challenge of advanced cyber-attacks.
Key facts
- Scheme
- FIPS 140
- Certificate
- 5354
- Standard
- FIPS 140-3
- Security level
- Level 2
- Status
- active
- Vendor
- Palo Alto Networks Inc.
- Module type
- Hardware
- Embodiment
- MultiChipStand
- Lab
- Leidos Accredited Testing & Evaluation (AT&E) Lab
- First validated
- June 25, 2026
- Sunset date
- June 24, 2031
- Caveat
- When installed, initialized and configured as specified in Section 11.1 of the Security Policy. The tamper evident seals and physical kit installed as indicated in the Security Policy. The module generates SSPs (e.g., keys) whose strengths are modified by available entropy
- Level exceptions
- Life-cycle assurance: Level 3; Mitigation of other attacks: N/A; Non-invasive security: N/A; Operational environment: N/A; Roles, services, and authentication: Level 3
Algorithms
- AES-CBC
- AES-CCM
- AES-CFB1
- AES-CFB128
- AES-CFB8
- AES-CTR
- AES-GCM
- Counter DRBG
- ECDSA KeyGen (FIPS186-4)
- ECDSA KeyVer (FIPS186-4)
- ECDSA SigGen (FIPS186-4)
- ECDSA SigVer (FIPS186-4)
- HMAC-SHA-1
- HMAC-SHA2-224
- HMAC-SHA2-256
- HMAC-SHA2-384
- HMAC-SHA2-512
- KAS-ECC-SSC Sp800-56Ar3
- KAS-FFC-SSC Sp800-56Ar3
- KDF IKEv2
- KDF SNMP
- KDF SSHA3453
- RSA KeyGen (FIPS186-4)
- RSA SigGen (FIPS186-4)
- RSA SigVer (FIPS186-4)
- Safe Primes Key Generation
- Safe Primes Key Verification
- SHA-1
- SHA2-224
- SHA2-256
- SHA2-384
- SHA2-512
- TLS v1.2 KDF RFC7627
Algorithm families of the CAVP certificates listed for this module, plus post-quantum algorithms named in its documents.
CAVP algorithm certificates (32)
- AES-CBC A3453
- AES-CCM A3453
- AES-CFB1 A3453
- AES-CFB128 A3453
- AES-CFB8 A3453
- AES-CTR A3453
- AES-GCM A3453
- Counter DRBG A3453
- ECDSA KeyGen (FIPS186-4) A3453
- ECDSA KeyVer (FIPS186-4) A3453
- ECDSA SigGen (FIPS186-4) A3453
- ECDSA SigVer (FIPS186-4) A3453
- HMAC-SHA-1 A3453
- HMAC-SHA2-224 A3453
- HMAC-SHA2-256 A3453
- HMAC-SHA2-384 A3453
- HMAC-SHA2-512 A3453
- KAS-ECC-SSC Sp800-56Ar3 A3453
- KAS-FFC-SSC Sp800-56Ar3 A3453
- KDF IKEv2 A3453
- KDF SNMP A3453
- RSA KeyGen (FIPS186-4) A3453
- RSA SigGen (FIPS186-4) A3453
- RSA SigVer (FIPS186-4) A3453
- Safe Primes Key Generation A3453
- Safe Primes Key Verification A3453
- SHA-1 A3453
- SHA2-224 A3453
- SHA2-256 A3453
- SHA2-384 A3453
- SHA2-512 A3453
- TLS v1.2 KDF RFC7627 A3453
Each approved algorithm in a FIPS 140-3 module needs its own NIST CAVP certificate. Older numeric certificates link to their NIST page; ACVP certificates (A1234) can be looked up in the CAVP validation search.
CVEs that may affect this product
sec-certs has not matched any CVE to this certificate. That is not proof the product is unaffected.
Related CVEs and certificate references are automated matches by sec-certs, not reviewed by humans: treat them as "may be affected" and verify before acting.
Documents and sources
Source: sec-certs.org (CRoCS, Masaryk University), from NIST CMVP, the Common Criteria Portal and ENISA (EUCC) - dataset of September 21, 2026 - synced October 17, 2026
Check certifications from your AI assistant
The Security Certifications Explorer answers FIPS 140-3 and Common Criteria questions directly inside Claude, ChatGPT, or any MCP assistant, and links each certificate to the CVEs that may affect it.
Add the certifications brain