In 2019, the Indian Government revokes Article 370 of the Indian Constitution, which grants special status for Jammu and Kashmir. The news impacts a cancer-ridden Pakistani Army officer, General Qadir, who decides to exact vengeance against India and signs a contract with a private terrorist organisation called Outfit X.

2022: Pathaan, a RAW agent, travels to Africa and captures arms dealer Raafe, who is alarmed to see that he is still alive. Back in India, upon inquisition by a junior, RAW officer Nandini Grewal narrates Pathaan's past after something they have been looking for is found.

2020: Shortly after he finishes a mission in Afghanistan, Pathaan and Nandini form a unit known as "Joint Operations and Covert Research" (J.O.C.R.) to recruit ex-agents and soldiers who were forced to retire, but want to continue serving their country. With Colonel Sunil Luthra's permission, Pathaan and his team head to Dubai to stop Outfit X's suspected plans of attacking the President of India. However, too late they realize that their actual plan was to kidnap two scientists, Dr. Farooqui and Dr. Sahani, who were initially supposed to be part of the President's convoy.

Jim, who leads Outfit X, attacks the scientists' convoy and Pathaan tries to stop him. A fight ensues and Jim manages to escape with Dr. Sahani. During a debrief back at agency headquarters, Luthra reveals to Pathaan and Nandini that Jim was a former agent and Kabir's former partner, who was awarded the Vir Puraskar for his bravery, his uncle filling in for him to the "posthumous" hunour, after the agency could not find his body when Somalian terrorists kidnapped him and killed his pregnant wife out of vengeance for a ransom deal gone wrong. He faked his death in order to seek vengeance against the country.

Meanwhile, Pathaan is made aware of a codeword, "Raktbeej", in the process, he learns that the dead people in Dubai were ex-agents and their money was transferred from the account of Rubina "Rubai" Mohsin, a Pakistani doctor in Spain. Pathaan travels to Spain and is captured by Jim's men, all former agents of their respective national intelligence agencies, where he also learns that Rubai is an ex-ISI agent, and Raafe his henchman. When Jim leaves his hideout, Rubai attacks Jim's men and escapes with Pathaan. Following a nightmare about her childhood wherein her father, a doctor, was forcibly tortured to death by the ISI, Rubai reveals that Raktbeej is in Moscow, and they travel to steal it before Jim does. Pathaan reveals to Rubai how he was given his name after he helped rescue children in an Afghan village; he was born an orphan abandoned in a cinema hall. Almost on the verge of the mission being successful, Rubai betrays Pathaan and has him captured by the Russian police. It is revealed that Jim used Rubai to make Pathaan steal the Raktbeej for himself. After Nandini disclaims him, Pathaan is taken to prison by a train, but is saved by Tiger; they promise to meet on one of Tiger's later missions.

2022: Pathaan meets Nandini and reveals that Jim is purchasing two Saber missiles, while Nandini reveals Rubai's location in Paris. Pathaan meets Rubai, who reveals that "Raktbeej" is codeword to a mutated smallpox virus, which was forcibly developed by a captive Dr. Sahani under Jim's orders. She also expresses guilt about betraying Pathaan without knowing that her country would plan such a heinous attack. They travel to Jim's lab in Siberia and manage to recover one orb containing the virus, while Jim escapes with the other orb. Luthra and Nandini reach Jim's lab to take the orb back to India in order to develop a vaccine.

At the Indian Institute of Contagious Diseases, Dr. Farooqui opens up the orb to Nandini without apparently finding anything. Jim calls them and reveals that the orb has already spread the virus in the facility. Later, the facility is destroyed in a controlled blast. Jim provides an ultimatum to evacuate Indian soldiers out of Kashmir within 24 hours. Pathaan learns that the missile is situated in Afghanistan. After rescuing Rubai, they lure Jim's associates into a trap and attack Jim's base. Qadir is killed by Rubai after he activates the missile.

Meanwhile, Rubai deactivates the missile, but finds that Raktbeej is not in the missile, but instead in a passenger-bound airplane, which is about to land in Delhi. Rubai informs Pathaan, who finds that Jim has the detonator. Luthra calls the air traffic control to prevent the plane from landing in Delhi. Crashing into a cabin after a long chase mid-air. Enraged, Pathaan and Jim fight brutally. Pathaan steals the detonator, deactivates Raktbeej, and kills Jim. Afterward, Pathaan is reinstated and made the head of J.O.C.R., while Nandini is posthumously awarded with the Vir Puraskar for her bravery.

During a mid-credits scene harking back to their interaction, Pathaan and Tiger are seen pondering about retiring and suggesting young agents who can replace them, but eventually decide to keep fighting the threats themselves.^[b]