CVE-2026-0326: PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing (Severity: LOW)
A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption.
Panorama and Prisma® Access are not affected by this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 12.2.4-h2Fixed in 12.1.10-h4Fixed in 11.2.16-h2Fixed in 11.1.16-h5 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.1.16-h5 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 11.2.16-h2 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.1.10-h4 - Upgrade
Upgrade
Palo Alto Networks PAN-OSto a version that resolves this vulnerability.Fixed in 12.2.4-h2 - Configuration
For each configured DNS Proxy object, uncheck Enable, then click OK and Commit the changes.
PAN-OS DNS Proxy Enable = disabled - Configuration
Detach the SCTP Protection profile from active Security Policy rules allowing SCTP traffic.
SCTP Protection profile Security Policy rule attachment = detached - Configuration
Update active OSPFv3 Auth Profiles under Network > Network Profiles > OSPFv3 Auth to use standard cryptographic authentication other than ESP-NULL.
PAN-OS OSPFv3 Auth Profiles Cryptographic authentication = standard cryptographic authentication other than ESP-NULL
Event History
Frequently Asked Questions
Which deployments are not affected?
Panorama and Prisma Access are not affected by this vulnerability.
Does exploitation require authentication or user interaction?
No. The vulnerability can be exploited by an unauthenticated attacker, and the supplied vector indicates no user interaction is required.
What is the expected impact of successful exploitation?
An attacker can disrupt service processing by causing a service process crash or memory corruption. The supplied impact metrics indicate low impact to confidentiality, integrity, and availability.