CVE-2026-0317: PAN-OS: Denial of Service Vulnerability
A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request.
The security risk posed by this issue is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .
Cloud NGFW, Panorama, and Prisma® Access are not affected by this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.1.10-h2 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.16 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.16-h3 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.2.4 - Compensating control
Restrict access to the PAN-OS management web interface to trusted internal IP addresses.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated access with a read-only administrator role and must be able to send a specially crafted API request to the PAN-OS management interface.
Which deployments are not affected?
Cloud NGFW, Panorama, and Prisma Access are not affected. The issue applies to Palo Alto Networks PAN-OS software.
What can reduce exposure if immediate remediation is not possible?
Restrict access to the management web interface to trusted internal IP addresses. This significantly minimizes the security risk by limiting who can reach the management interface.