CVE-2026-0321: PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services (Severity: MEDIUM)

Published Oct 14, 2026

Updated

Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.

Cloud NGFW and Panorama are not affected by this vulnerability.

Affected Software

3 affected componentsFixes available

Palo Alto Networks Cloud NGFW

Palo Alto Networks PAN-OS=12.2.0, =12.1.0, =11.2.0, =11.1.0, =10.2.0

12.2.412.1.10-h212.1.7-h812.1.4-h1211.2.1611.2.13-h311.2.10-h1511.2.7-h2111.2.4-h2211.1.16-h311.1.13-h1511.1.10-h3511.1.7-h1111.1.6-h3911.1.4-h3710.2.18-h1210.2.16-h1110.2.13-h2610.2.10-h4110.2.7-h38

Palo Alto Networks Prisma Access=12.1.0, =11.2.0, =10.2.0

12.1.7-h811.2.7-h2110.2.10-h41

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.2.4Fixed in 12.1.10-h2Fixed in 12.1.7-h8Fixed in 12.1.4-h12Fixed in 11.2.16Fixed in 11.2.13-h3Fixed in 11.2.10-h15Fixed in 11.2.7-h21Fixed in 11.2.4-h22Fixed in 11.1.16-h3Fixed in 11.1.13-h15Fixed in 11.1.10-h35Fixed in 11.1.7-h11Fixed in 11.1.6-h39Fixed in 11.1.4-h37Fixed in 10.2.18-h12Fixed in 10.2.16-h11Fixed in 10.2.13-h26Fixed in 10.2.10-h41Fixed in 10.2.7-h38
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.1.7-h8Fixed in 11.2.7-h21Fixed in 10.2.10-h41
Upgrade
Upgrade Palo Alto Networks PAN-OS 10.2 to a version that resolves this vulnerability.
Fixed in 10.2.18-h12
Upgrade
Upgrade Palo Alto Networks PAN-OS 11.1 to a version that resolves this vulnerability.
Fixed in 11.1.16-h3
Upgrade
Upgrade Palo Alto Networks PAN-OS 11.2 to a version that resolves this vulnerability.
Fixed in 11.2.16
Upgrade
Upgrade Palo Alto Networks PAN-OS 12.1 to a version that resolves this vulnerability.
Fixed in 12.1.10-h2
Upgrade
Upgrade Palo Alto Networks PAN-OS 12.2 to a version that resolves this vulnerability.
Fixed in 12.2.4
Upgrade
Upgrade Prisma Access 10.2 to a version that resolves this vulnerability.
Fixed in 10.2.10-h41
Upgrade
Upgrade Prisma Access 11.2 to a version that resolves this vulnerability.
Fixed in 11.2.7-h21
Upgrade
Upgrade Prisma Access 12.1 to a version that resolves this vulnerability.
Fixed in 12.1.7-h8
Configuration
Enable Threat ID 510038 using Applications and Threats content version 9158-10284 or later; this coverage requires SSL Decryption.
PAN-OS Threat Prevention Threat ID 510038 = enabled

Event History

Oct 14, 2026

Advisory Published

via Palo Alto Networks·04:00 PM

Data Sourced

via Palo Alto Networks·04:00 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which deployments are affected or excluded?

The issue affects PAN-OS software. Cloud NGFW and Panorama are explicitly not affected; the provided information does not state whether Prisma Access is affected.

What access does an attacker need to trigger the issue?

An attacker does not need authentication or user interaction, but must have network access to send specially crafted traffic to or through a dataplane interface.

What is the operational impact of repeated exploitation?

Repeated attempts to trigger the condition can cause the firewall to enter maintenance mode, resulting in a denial-of-service condition.