Palo Alto Networks PAN-OS: Sensitive information disclosure via dataplane
Summary
A flaw in PAN-OS, the operating system of Palo Alto Networks firewalls, allows an unauthenticated remote attacker with network access to obtain sensitive firewall and session information. The attacker only needs to send traffic to or through a dataplane interface. Panorama is not affected, and no special configuration is required for exposure.
Affected
- PAN-OS 12.2.0 to before 12.2.4-h2
- PAN-OS 12.1.0 to before 12.1.10-h4
- PAN-OS 11.2.0 to before 11.2.16-h2
- PAN-OS 11.1.0 to before 11.1.16-h5
- PAN-OS 10.2.0 to before 10.2.18-h14
- Prisma Access 12.1, 11.2 and 10.2 (vendor-managed, before the fixed versions listed in the advisory)
- Cloud NGFW: vendor-managed, see advisory
- Older unsupported PAN-OS versions are affected; no fix is available for them.
Fixed in
- PAN-OS 12.2: 12.2.4-h2 or later
- PAN-OS 12.1: 12.1.10-h4 or later (12.1.7-h12 and 12.1.4-h14 for older hotfix branches)
- PAN-OS 11.2: 11.2.16-h2 or later (11.2.13-h5, 11.2.10-h18, 11.2.7-h24 and 11.2.4-h24 for older hotfix branches)
- PAN-OS 11.1: 11.1.16-h5 or later (11.1.13-h17, 11.1.10-h37, 11.1.7-h13, 11.1.6-h41 and 11.1.4-h39 for older hotfix branches)
- PAN-OS 10.2: 10.2.18-h14 or later (10.2.16-h13, 10.2.13-h28, 10.2.10-h43 and 10.2.7-h40 for older hotfix branches)
- Verify the exact fixed version for each branch on the live advisory.
Workaround
Unknown.
- The vendor states that no known workarounds exist for this issue.
Exploitation
- Palo Alto Networks is not aware of any malicious exploitation of this issue.
- No public proof of concept was found; VulDB reports no exploit available.
- Not listed in the CISA KEV catalog in the sources reviewed.
Our recommendation
- Upgrade PAN-OS to the fixed version for your branch, scheduling the upgrade sooner for internet-facing firewalls.
- Check which dataplane interfaces are reachable from untrusted networks and restrict access where possible.
- Verify the live advisory and the CISA KEV catalog before and after patching.
- Monitor firewall logs for unusual traffic to or through dataplane interfaces.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Palo Alto Networks Security Advisory CVE-2026-0331 security.paloaltonetworks.com
- CVE Program record CVE-2026-0331 www.cve.org
- VulDB CVE-2026-0331 vuldb.com
- PAN-OS 11.1.16-h5 addressed issues docs.paloaltonetworks.com
- OffSeq Radar CVE-2026-0331 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:22.
Original description (NVD)
An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network access to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. Panorama is not affected by this vulnerability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.