CVE-2026-0329 PAN-OS: Buffer Overflow Vulnerability
Description
A buffer overflow vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface.
Cloud NGFW and Panorama are not affected by this vulnerability.
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Cloud NGFW | None | All |
| PAN-OS 12.2 | < 12.2.4-h2 | >= 12.2.4-h2 |
| PAN-OS 12.1 | < 12.1.4-h14 < 12.1.7-h12 < 12.1.10-h4 | >= 12.1.4-h14 >= 12.1.7-h12 >= 12.1.10-h4 |
| PAN-OS 11.2 | < 11.2.4-h24 < 11.2.7-h24 < 11.2.10-h18 < 11.2.13-h5 < 11.2.16-h2 | >= 11.2.4-h24 >= 11.2.7-h24 >= 11.2.10-h18 >= 11.2.13-h5 >= 11.2.16-h2 |
| PAN-OS 11.1 | < 11.1.4-h39 < 11.1.6-h41 < 11.1.7-h13 < 11.1.10-h37 < 11.1.13-h17 < 11.1.16-h5 | >= 11.1.4-h39 >= 11.1.6-h41 >= 11.1.7-h13 >= 11.1.10-h37 >= 11.1.13-h17 >= 11.1.16-h5 |
| PAN-OS 10.2 | < 10.2.7-h40 < 10.2.10-h43 < 10.2.13-h28 < 10.2.16-h13 < 10.2.18-h14 | >= 10.2.7-h40 >= 10.2.10-h43 >= 10.2.13-h28 >= 10.2.16-h13 >= 10.2.18-h14 |
| Prisma Access 12.1 | < 12.1.10-h4* | >= 12.1.10-h4* |
| Prisma Access 11.2 | < 11.2.7-h24* | >= 11.2.7-h24* |
| Prisma Access 10.2 | < 10.2.10-h43* | >= 10.2.10-h43* |
* This is a low severity vulnerability for Prisma Access. Palo Alto Networks Prisma Access will upgrade all customers during the next scheduled maintenance cycle. Customers who require an upgrade prior to this cycle should contact Palo Alto Networks Support or their account teams to schedule an on-demand software upgrade window.
Required Configuration for Exposure
Customers are impacted only if the following conditions are true:
An active IKE Gateway uses certificate-based authentication with CRL or OCSP revocation checking enabled, or
A DNS Proxy object is configured and enabled on the firewall.
Verify IKE Gateway Authentication and Certificate Profile:
Navigate to Network > Network Profiles > IKE Gateways.
Click on your active IKE Gateway name to open the configuration.
Under the General tab:
Verify Authentication is set to Certificate.
Confirm that a Certificate Profile is assigned.
Verify CRL and OCSP Checking on the Certificate Profile:
Navigate to Device > Certificate Management > Certificate Profile.
Click on the Certificate Profile identified in the previous step.
Under the profile settings, verify if:
Use CRL is enabled or
Use OCSP is enabled.
Verify DNS Proxy Status:
Navigate to Network > DNS Proxy.
Review all configured DNS Proxy objects.
Click to open each DNS Proxy object and verify whether the Enable checkbox is selected.
Severity: MEDIUM, Suggested Urgency: MODERATE
CVSS-BT: 4.6 / CVSS-B: 8.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Weakness Type and Impact
Solution
| Version | Minor Version | Suggested Solution |
|---|---|---|
| Cloud NGFW | No action needed. | |
| PAN-OS 12.2 |
12.2.0 through 12.2.4-h* | Upgrade to 12.2.4-h2 or later. |
| PAN-OS 12.1 | 12.1.8 through 12.1.10-h* | Upgrade to 12.1.10-h4 or later. |
| 12.1.5 through 12.1.7-h* | Upgrade to 12.1.7-h12 or later. | |
| 12.1.2 through 12.1.4-h* | Upgrade to 12.1.4-h14 or later. | |
| PAN-OS 11.2 |
11.2.15 through 11.2.16-h* | Upgrade to 11.2.16-h2 or later. |
| 11.2.11 through 11.2.13-h* | Upgrade to 11.2.13-h5 or 11.2.16-h2 or later. |
|
| 11.2.8 through 11.2.10-h* | Upgrade to 11.2.10-h18 or 11.2.16-h2 or later. | |
| 11.2.5 through 11.2.7-h* | Upgrade to 11.2.7-h24 or 11.2.16-h2 or later. | |
| 11.2.0 through 11.2.4-h* | Upgrade to 11.2.4-h24 or 11.2.16-h2 or later. | |
| PAN-OS 11.1 |
11.1.14 through 11.1.16-h* | Upgrade to 11.1.16-h5 or later. |
| 11.1.11 through 11.1.13-h* | Upgrade to 11.1.13-h17 or 11.1.16-h5 or later. | |
| 11.1.8 through 11.1.10-h* | Upgrade to 11.1.10-h37 or 11.1.16-h5 or later. | |
| 11.1.7 through 11.1.7-h* | Upgrade to 11.1.7-h13 or 11.1.16-h5 or later. | |
| 11.1.5 through 11.1.6-h* | Upgrade to 11.1.6-h41 or 11.1.16-h5 or later. | |
| 11.1.0 through 11.1.4-h* | Upgrade to 11.1.4-h39 or 11.1.16-h5 or later. | |
| PAN-OS 10.2 |
10.2.17 through 10.2.18-h* | Upgrade to 10.2.18-h14 or later. |
| 10.2.14 through 10.2.16-h* | Upgrade to 10.2.16-h13 or 10.2.18-h14 or later. | |
| 10.2.11 through 10.2.13-h* | Upgrade to 10.2.13-h28 or 10.2.18-h14 or later. | |
| 10.2.8 through 10.2.10-h* | Upgrade to 10.2.10-h43 or 10.2.18-h14 or later. | |
| 10.2.0 through 10.2.7-h* | Upgrade to 10.2.7-h40 or 10.2.18-h14 or later. | |
| All older unsupported PAN-OS versions | Upgrade to a supported fixed version. | |
| Prisma Access 12.1 |
12.1.2 through 12.1.10-h* | Upgrade to 12.1.10-h4 or later. |
| Prisma Access 11.2 |
11.2.0 through 11.2.7-h* | Upgrade to 11.2.7-h24 or later. |
| Prisma Access 10.2 |
10.2.0 through 10.2.10-h* | Upgrade to 10.2.10-h43 or later. |
* See the note under Product Status for information regarding Prisma Access upgrades.
Workarounds and Mitigations
Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510051 and 510052 (from Applications and Threats content version 9171-10349 and later). For these Threat IDs to protect against attacks for this vulnerability:
- Route incoming traffic for the MGT port through a DP port, e.g., enabling management profile on a DP interface for management access.
- Replace the Certificate for Inbound Traffic Management.
- Decrypt inbound traffic to the management interface so the firewall can inspect it.
- Enable threat prevention on the inbound traffic to management services.
Please note that this Threat ID requires SSL Decryption.
Customers can mitigate the risk of this issue by taking the following actions.
Disable CRL and OCSP Revocation Checking:
Click on the Certificate Profile assigned to the active IKE Gateway.
Uncheck Use CRL.
Uncheck Use OCSP.
Click OK and Commit the changes.
Disable configured DNS proxy objects:
Navigate to Network > DNS Proxy.
Click on each configured DNS Proxy object.
Uncheck the Enable checkbox.
Click OK and Commit the changes.
Acknowledgments
CPEs
cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:h1:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:-:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.2.3:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.2.2:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h3:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h2:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:-:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.9:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.8:*:*:*:*:*:*:*
cpe:2.3:o:palo_alto_networks:pan-os:12.1.7:h11:*:*:*:*:*:*
CPE Applicability
- cpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.2.4 and up to (excluding)12.2.4-h2
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.10 and up to (excluding)12.1.10-h4
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.7 and up to (excluding)12.1.7-h12
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.4 and up to (excluding)12.1.4-h14
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.16 and up to (excluding)11.2.16-h2
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.13 and up to (excluding)11.2.13-h5
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.10 and up to (excluding)11.2.10-h18
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.7 and up to (excluding)11.2.7-h24
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.4 and up to (excluding)11.2.4-h24
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.16 and up to (excluding)11.1.16-h5
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.13 and up to (excluding)11.1.13-h17
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.10 and up to (excluding)11.1.10-h37
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.7 and up to (excluding)11.1.7-h13
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.6 and up to (excluding)11.1.6-h41
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)11.1.4 and up to (excluding)11.1.4-h39
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.18 and up to (excluding)10.2.18-h14
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.16 and up to (excluding)10.2.16-h13
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.13 and up to (excluding)10.2.13-h28
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.10 and up to (excluding)10.2.10-h43
- ORcpe:2.3:o:palo_alto_networks:pan-os:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.7 and up to (excluding)10.2.7-h40
- or
- cpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:* is vulnerable from (including)12.1.10 and up to (excluding)12.1.10-h4
- ORcpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:* is vulnerable from (including)11.2.7 and up to (excluding)11.2.7-h24
- ORcpe:2.3:o:palo_alto_networks:prisma_access:*:*:*:*:*:*:*:* is vulnerable from (including)10.2.10 and up to (excluding)10.2.10-h43