CVE-2026-0317 PAN-OS: Denial of Service Vulnerability

Palo Alto Networks Security Advisories / CVE-2026-0317

CVE-2026-0317 PAN-OS: Denial of Service Vulnerability

Urgency MODERATE

Severity 1.2 · LOW

Exploit Maturity UNREPORTED

Response Effort LOW

Recovery AUTOMATIC

Value Density DIFFUSE

Attack Vector NETWORK

Attack Complexity LOW

Attack Requirements NONE

Automatable NO

User Interaction NONE

Product Confidentiality NONE

Product Integrity NONE

Product Availability LOW

Privileges Required HIGH

Subsequent Confidentiality NONE

Subsequent Integrity NONE

Subsequent Availability NONE

CVE JSON CSAF

Published 2026-10-14

Updated 2026-08-12

Discovered externally

Description

A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request.

The security risk posed by this issue is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines.

Cloud NGFW, Panorama, and Prisma® Access are not affected by this vulnerability.

Product Status

Versions	Affected	Unaffected
Cloud NGFW	None	All
PAN-OS 12.2	< 12.2.4	>= 12.2.4
PAN-OS 12.1	< 12.1.10-h2	>= 12.1.10-h2
PAN-OS 11.2	< 11.2.16	>= 11.2.16 (ETA: 10/15)
PAN-OS 11.1	< 11.1.16-h3	>= 11.1.16-h3
Prisma Access	None	All

Required Configuration for Exposure

No special configuration is required to be affected by this issue.

Severity: LOW, Suggested Urgency: MODERATE

CVSS-BT: 1.2 / CVSS-B: 5.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:L/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type and Impact

CWE-754 Improper Check for Unusual or Exceptional Conditions

CAPEC-130 Excessive Allocation

Solution

Version	Minor Version Range	Suggested Solution
Cloud NGFW		No action required.
PAN-OS 12.1	12.2.0 through 12.2.3-h*	Upgrade to 12.2.4 or later.
PAN-OS 12.1	12.1.2 through 12.1.10-h*	Upgrade to 12.1.10-h2 or later.
PAN-OS 11.2	11.2.0 through 11.2.15-h*	Upgrade to 11.2.16 or later.
PAN-OS 11.1	11.1.0 through 11.1.16-h*	Upgrade to 11.1.16-h3 or later.
All other older unsupported PAN-OS versions		Upgrade to a supported fixed version.
Prisma Access		No action needed.

Workarounds and Mitigations

No known workarounds exist for this issue.

Acknowledgments

Palo Alto Networks thanks Michael Messner and Benedikt Kuehne for discovering and reporting this issue.

CPEs

cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:12.1.6:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:12.1.5:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:12.1.4:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:12.1.3:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:12.1.2:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.15:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.13:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.12:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.11:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.10:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.9:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.8:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.7:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.6:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.5:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.4:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.3:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.2:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.1:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.2.0:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h2:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h1:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:-:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.15:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.14:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.13:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.12:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.11:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.10:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.9:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.8:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.6:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.5:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.4:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.3:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.2:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.1:*:*:*:*:*:*:*

cpe:2.3:o:palo_alto_networks:pan-os:11.1.0:*:*:*:*:*:*:*

Show MoreShow Less

CPE Applicability

cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.2.0 and up to (excluding)12.2.4
ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.10 and up to (excluding)12.1.10-h2
ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.0 and up to (excluding)11.2.16
ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.16 and up to (excluding)11.1.16-h3

Timeline

2026-08-12 Initial publication