PAN-OS: Buffer overflow enables denial of service

Summary

A buffer overflow in the dataplane of Palo Alto Networks PAN-OS allows an unauthenticated attacker with network access to crash or disrupt the firewall by sending specially crafted network traffic. According to the CVSS vector, confidentiality and integrity are not affected, but availability is highly affected. Cloud NGFW and Panorama are not affected, and according to the advisory customers are only impacted under certain configurations.

Affected

• PAN-OS 12.2.0 to below 12.2.4-h2
• PAN-OS 12.1 builds below the fixed builds of their branch (for example 12.1.10-h4, 12.1.7-h12, 12.1.4-h14)
• PAN-OS 11.2 builds below the fixed builds of their branch (for example 11.2.16-h2, 11.2.13-h5, 11.2.10-h18, 11.2.7-h24, 11.2.4-h24)
• PAN-OS 11.1 builds below the fixed builds of their branch (for example 11.1.16-h5)
• PAN-OS 10.2 builds below the fixed builds of their branch (for example 10.2.18-h14)
• Older unsupported PAN-OS versions
• Prisma Access 10.2, 11.2 and 12.1 builds below the fixed versions listed in the advisory
• Cloud NGFW: not affected
• Panorama: not affected

Fixed in

• PAN-OS 12.2: 12.2.4-h2 or later
• PAN-OS 12.1: 12.1.10-h4, 12.1.7-h12 or 12.1.4-h14 or later, depending on branch
• PAN-OS 11.2: 11.2.16-h2 or later, or the per-branch fix listed in the advisory
• PAN-OS 11.1: 11.1.16-h5 or later
• PAN-OS 10.2: 10.2.18-h14 or later
• Older unsupported PAN-OS versions: upgrade to a supported fixed version

Workaround

Limited coverage only. Customers with a Threat Prevention subscription can enable Threat IDs 510051 and 510052 (Applications and Threats content version 9171-10349 or later). The advisory also suggests routing management traffic through a dataplane port. Restricting the management interface does not address this issue, because the attack arrives through the dataplane.

Exploitation

• Palo Alto Networks is not aware of any malicious exploitation of this issue.
• No public proof of concept and no CISA KEV listing were found at the time of writing.

Our recommendation

• Check which PAN-OS firewalls you run and whether they are on an affected version.
• Check the exposure conditions in the advisory: an active IKE gateway with certificate authentication and CRL or OCSP checking, or an enabled DNS Proxy object.
• Patch to the fixed version in the next regular maintenance window, or sooner if the exposure conditions apply.
• Monitor firewall availability and logs for crashes or unexpected restarts.
• Recheck exploitation status after patching.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Palo Alto Networks Security Advisory CVE-2026-0329 security.paloaltonetworks.com
• Third-party tracker: CVE-2026-0329 (CWE-787) radar.offseq.com
• Palo Alto Networks Security Advisories CSV security.paloaltonetworks.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:24.