A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption.
Panorama and Prisma® Access are not affected by this vulnerability.
" } ] } ], "references": [ { "url": "https://security.paloaltonetworks.com/CVE-2026-0326", "tags": [ "vendor-advisory" ] } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NO", "Recovery": "USER", "valueDensity": "DIFFUSE", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "AMBER", "version": "4.0", "baseSeverity": "LOW", "baseScore": 1.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber" } } ], "configurations": [ { "lang": "eng", "value": "Customers are impacted if the following conditions are true:\n\n 1. SCTP is enabled or\n\n 2. DNS proxy object is configured and enabled on the firewall or\n\n 3. OSPFv3 routing on an IPv6 interface is enabled.\n\nTo check if SCTP is enabled: \n\n * Navigate to Device > Setup > Management (https://docs.paloaltonetworks.com/ngfw/help/10-2/device/device-setup-management) > General Settings and check if SCTP Security (https://docs.paloaltonetworks.com/service-providers/10-2/mobile-network-infrastructure-getting-started/sctp/configure-sctp-security) is checked.\n \n * Navigate to Policies > Security (https://docs.paloaltonetworks.com/ngfw/help/10-2/policies/policies-security), inspect your active policy rules, and verify if an SCTP Protection profile (https://docs.paloaltonetworks.com/ngfw/help/10-1/objects/objects-security-profiles-sctp-protection) is applied under the rule's Actions tab to a rule allowing SCTP traffic.\n\nVerify DNS Proxy Status:\n\n * Navigate to Network > DNS Proxy (https://docs.paloaltonetworks.com/ngfw/help/10-1/network/network-dns-proxy).\n \n * Review all configured DNS Proxy objects.\n \n * Click to open each DNS Proxy object and verify whether the Enable checkbox is selected.\n\nVerify OSPFv3 routing on IPv6\n\n * Navigate to Network > Virtual Routers (https://docs.paloaltonetworks.com/ngfw/help/10-2/network/network-virtual-routers) (or Advanced Routing (https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing)), open your active virtual router, and check under OSPFv3 (https://docs.paloaltonetworks.com/ngfw/networking/ospf/configure-ospfv3) to confirm if OSPFv3 routing is enabled on any IPv6 interface or subinterface.\n\n * Navigate to Network > Network Profiles > OSPFv3 Auth (https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing/create-ospfv3-routing-profiles) (or view the profile attached to the OSPFv3 area/interface). Inspect the SPI configuration (https://docs.paloaltonetworks.com/ngfw/networking/ospf/configure-ospfv3) to see if: ESP Authentication is set to NONE.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "Customers are impacted if the following conditions are true:
SCTP is enabled or
DNS proxy object is configured and enabled on the firewall or
OSPFv3 routing on an IPv6 interface is enabled.
Navigate to Network > Network Profiles > OSPFv3 Auth (or view the profile attached to the OSPFv3 area/interface). Inspect the SPI configuration to see if: ESP Authentication is set to NONE.
Customers can mitigate the risk of this issue by taking the following actions.
Detach the SCTP Protection profile from active Security Policy rules allowing SCTP traffic.
Disable configured DNS proxy objects:
Navigate to Network > DNS Proxy.
Click on each configured DNS Proxy object.
Uncheck the Enable checkbox.
Click OK and Commit the changes.
Update any active OSPFv3 Auth Profiles under Network > Network Profiles > OSPFv3 Auth to use standard cryptographic authentication other than ESP-NULL.
| Version | Minor Version | Suggested Solution |
|---|---|---|
| Cloud NGFW | Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. | |
| PAN-OS 12.2 | \n 12.2.0 through 12.2.4-h* | \nUpgrade to 12.2.4-h2 or later. | \n
| PAN-OS 12.1 | \n 12.1.0 through 12.1.10-h* | \nUpgrade to 12.1.10-h4 or later. | \n
| PAN-OS 11.2 | \n 11.2.0 through 11.2.16-h* | \nUpgrade to 11.2.16-h2 or later. | \n
| PAN-OS 11.1 | \n 11.1.0 through 11.1.16-h* | \nUpgrade to 11.1.16-h5 or later. | \n
| All older unsupported PAN-OS versions | Upgrade to a supported fixed version. | |
| Prisma Access | No action needed. |