CVE-2026-0326 PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing
Description
A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption.
Panorama and Prisma® Access are not affected by this vulnerability.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cloud NGFW | All* | None* |
| PAN-OS 12.2 | < 12.2.4-h2 | >= 12.2.4-h2 |
| PAN-OS 12.1 | < 12.1.10-h4 | >= 12.1.10-h4 |
| PAN-OS 11.2 | < 11.2.16-h2 | >= 11.2.16-h2 |
| PAN-OS 11.1 | < 11.1.16-h5 | >= 11.1.16-h5 |
| Prisma Access | None | All |
* Palo Alto Networks Cloud NGFW will upgrade all customers during the next scheduled maintenance cycle. Customers who require an upgrade prior to this cycle should contact Palo Alto Networks Support or their account teams to schedule an on-demand software upgrade window.
Required Configuration for Exposure
Customers are impacted if the following conditions are true:
SCTP is enabled or
DNS proxy object is configured and enabled on the firewall or
OSPFv3 routing on an IPv6 interface is enabled.
- Navigate to Device > Setup > Management > General Settings and check if SCTP Security is checked.
- Navigate to Policies > Security, inspect your active policy rules, and verify if an SCTP Protection profile is applied under the rule's Actions tab to a rule allowing SCTP traffic.
- Navigate to Network > DNS Proxy.
- Review all configured DNS Proxy objects.
- Click to open each DNS Proxy object and verify whether the Enable checkbox is selected.
- Navigate to Network > Virtual Routers (or Advanced Routing), open your active virtual router, and check under OSPFv3 to confirm if OSPFv3 routing is enabled on any IPv6 interface or subinterface.
Navigate to Network > Network Profiles > OSPFv3 Auth (or view the profile attached to the OSPFv3 area/interface). Inspect the SPI configuration to see if: ESP Authentication is set to NONE.
Severity: LOW, Suggested Urgency: MODERATE
CVSS-BT: 1.7 / CVSS-B: 6.3 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type and Impact
Solution
| Version | Minor Version | Suggested Solution |
|---|---|---|
| Cloud NGFW | Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. | |
| PAN-OS 12.2 |
12.2.0 through 12.2.4-h* | Upgrade to 12.2.4-h2 or later. |
| PAN-OS 12.1 |
12.1.0 through 12.1.10-h* | Upgrade to 12.1.10-h4 or later. |
| PAN-OS 11.2 |
11.2.0 through 11.2.16-h* | Upgrade to 11.2.16-h2 or later. |
| PAN-OS 11.1 |
11.1.0 through 11.1.16-h* | Upgrade to 11.1.16-h5 or later. |
| All older unsupported PAN-OS versions | Upgrade to a supported fixed version. | |
| Prisma Access | No action needed. |
Workarounds and Mitigations
Customers can mitigate the risk of this issue by taking the following actions.
Detach the SCTP Protection profile from active Security Policy rules allowing SCTP traffic.
Disable configured DNS proxy objects:
Navigate to Network > DNS Proxy.
Click on each configured DNS Proxy object.
Uncheck the Enable checkbox.
Click OK and Commit the changes.
Update any active OSPFv3 Auth Profiles under Network > Network Profiles > OSPFv3 Auth to use standard cryptographic authentication other than ESP-NULL.
Acknowledgments
CPEs
cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:h1:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:-:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h3:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h2:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:*:*:*:*:*:*:*
CPE Applicability
- cpe:2.3:o:palo_alto_networks:cloud_ngfw:*:*:*:*:*:*:*:* is vulnerable from (including)all
- or
- cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.2.4 and up to (excluding)12.2.4-h2
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.10 and up to (excluding)12.1.10-h4
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.16 and up to (excluding)11.2.16-h2
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.16 and up to (excluding)11.1.16-h5