VULNpocalypse
MediumVulnerabilityPatch available

Palo Alto discloses PAN-OS information disclosure flaw CVE-2026-0331

Palo Alto Networks says PAN-OS flaw CVE-2026-0331 can leak firewall and session data to unauthenticated attackers; upgrade to a fixed build.

Published
Fixed in
PAN-OS 12.2.4-h2, 12.1.4-h14, 12.1.7-h12, 12.1.10-h4, 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2, 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5, 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14 or later in the same train; Prisma Access 12.1.10-h4, 11.2.7-h24, 10.2.10-h43
Exploitation
No, Palo Alto Networks says it is not aware of any malicious exploitation (vendor statement, not independently verified)

What happened

According to its own security advisory, Palo Alto Networks disclosed CVE-2026-0331, a sensitive information disclosure vulnerability in PAN-OS software. Palo Alto Networks says an unauthenticated remote attacker with network access could obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. Palo Alto PSIRT

The advisory is dated 2026-11-11. Palo Alto Networks says it discovered the issue internally and thanks OpenAI and Rotem Bar (internal reporter) for finding and reporting it. It rates the issue MEDIUM with a suggested urgency of MODERATE, and a CVSS-BT score of 6.6 (CVSS-B 8.7). The weakness type is listed as CWE-200. Palo Alto PSIRT

What is not confirmed: this is a single vendor source, and no independent outlet or researcher has verified the details. The advisory does not describe which specific data can be read in practice. Palo Alto Networks says it is not aware of any malicious exploitation. Palo Alto PSIRT

Am I affected?

According to Palo Alto Networks, no special configuration is required to be affected. It says Panorama is not affected. Palo Alto PSIRT

The vendor lists these as affected, with the first unaffected release per maintenance line:

  • PAN-OS 12.2 below 12.2.4-h2.
  • PAN-OS 12.1 below 12.1.4-h14, 12.1.7-h12 or 12.1.10-h4.
  • PAN-OS 11.2 below 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5 or 11.2.16-h2.
  • PAN-OS 11.1 below 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17 or 11.1.16-h5.
  • PAN-OS 10.2 below 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13 or 10.2.18-h14.
  • Prisma Access 12.1 below 12.1.10-h4, 11.2 below 11.2.7-h24, and 10.2 below 10.2.10-h43.
  • Cloud NGFW: all versions listed as affected.
  • Older unsupported PAN-OS versions: the vendor says to upgrade to a supported fixed version.

Palo Alto Networks says the risk is highest for PA-Series and VM-Series firewalls, because of the risk of exfiltrating sensitive data. It rates the issue low severity for Cloud NGFW and medium for Prisma Access. For Prisma Access it says exploitation risk is lower because it requires an authenticated user and external network access is restricted (CVSS-BT 4.6, CVSS-B 6.9). Palo Alto PSIRT

What to do now

  1. Check the PAN-OS version on each firewall and compare it with the affected list in the Palo Alto Networks advisory.
  2. Upgrade to the fixed release for your version line as given by the vendor. Examples: 12.2.0 through 12.2.4-h* to 12.2.4-h2 or later; 11.2.0 through 11.2.4-h* to 11.2.4-h24 or 11.2.16-h2 or later; 10.2.17 through 10.2.18-h* to 10.2.18-h14 or later. The advisory has the full per-version table.
  3. If you run an older unsupported PAN-OS version, move to a supported fixed version, as the vendor advises.
  4. For Prisma Access and Cloud NGFW, Palo Alto Networks says it will upgrade all customers during the next scheduled maintenance cycle. If you need an upgrade sooner, contact Palo Alto Networks Support or your account team to schedule an on-demand window.
  5. Do not rely on a workaround: the vendor states that no known workarounds exist.

Sources