VULNpocalypse
LowVulnerabilityPatch available

Palo Alto discloses PAN-OS buffer overflow CVE-2026-0326

Palo Alto Networks says PAN-OS CVE-2026-0326 is a buffer overflow in SCTP, DNS proxy or OSPFv3 handling, so upgrade to a fixed version.

Published
Fixed in
PAN-OS 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5 or later
Exploitation
No, Palo Alto Networks says it is not aware of any malicious exploitation

What happened

According to Palo Alto Networks’ security advisory, CVE-2026-0326 is a buffer overflow in the protocol and service processing of PAN-OS. Palo Alto PSIRT says an unauthenticated attacker could disrupt service processing by causing a service process crash or memory corruption. The advisory was published on 2026-11-11.

Palo Alto Networks says it discovered the issue internally and thanks OpenAI, Rotem Bar (internal reporter) and Ben Nott (internal reporter) for finding and reporting it. It classifies the weakness as CWE-787 (out-of-bounds write).

The vendor rates the severity as LOW with a suggested urgency of MODERATE. It gives a CVSS-BT score of 1.7 and a CVSS-B score of 6.3. It also says it is not aware of any malicious exploitation of this issue. This is the only source for this story, and no independent confirmation or further technical detail is available.

Am I affected?

Palo Alto Networks says exposure depends on configuration. Customers are impacted if any of the following is true:

  • SCTP is enabled.
  • A DNS proxy object is configured and enabled on the firewall.
  • OSPFv3 routing on an IPv6 interface is enabled.

According to the advisory, affected versions are:

  • PAN-OS 12.2 before 12.2.4-h2
  • PAN-OS 12.1 before 12.1.10-h4
  • PAN-OS 11.2 before 11.2.16-h2
  • PAN-OS 11.1 before 11.1.16-h5
  • Cloud NGFW, all versions

Panorama and Prisma Access are not affected, according to the vendor. For older unsupported PAN-OS versions, the vendor says to upgrade to a supported fixed version.

How the vendor says to check each condition:

  • SCTP: go to Device > Setup > Management > General Settings and check whether SCTP Security is checked. Then go to Policies > Security and verify whether an SCTP Protection profile is applied under the Actions tab of a rule that allows SCTP traffic.
  • DNS proxy: go to Network > DNS Proxy, open each DNS Proxy object and check whether Enable is selected.
  • OSPFv3: go to Network > Virtual Routers (or Advanced Routing) and check whether OSPFv3 is enabled on any IPv6 interface or subinterface. Then go to Network > Network Profiles > OSPFv3 Auth and inspect the SPI configuration for ESP Authentication set to NONE.

What to do now

  1. Check whether your PAN-OS version is below the fixed release for your branch (see the list above).
  2. Check whether SCTP, DNS proxy or OSPFv3 on IPv6 is enabled, using the steps above.
  3. Upgrade to 12.2.4-h2, 12.1.10-h4, 11.2.16-h2 or 11.1.16-h5 or later, according to your branch.
  4. If you cannot upgrade yet, Palo Alto Networks lists these mitigations:
    • Detach the SCTP Protection profile from active Security Policy rules that allow SCTP traffic.
    • Disable configured DNS proxy objects: uncheck Enable on each one under Network > DNS Proxy, click OK and commit.
    • Update any active OSPFv3 Auth Profiles to use standard cryptographic authentication other than ESP-NULL.
  5. Cloud NGFW customers: the vendor says it will upgrade all customers during the next scheduled maintenance cycle. If you need an upgrade sooner, contact Palo Alto Networks Support or your account team to schedule an on-demand window.
  6. Prisma Access customers: the vendor says no action is needed.

Sources