{"id":"CVE-2026-0326","title":"PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing","summary":"A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption.\n\n\n\nPanorama and Prisma® Access are not affec…","severity":"low","cvss":1.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Palo Alto Networks","product":"Cloud NGFW","affected":["cloud_ngfw All","PAN-OS >= 12.2.0 < 12.2.4-h2","PAN-OS >= 12.1.0 < 12.1.10-h4","PAN-OS >= 11.2.0 < 11.2.16-h2","PAN-OS >= 11.1.0 < 11.1.16-h5","prisma_access"],"published":"2026-11-11","updated":"2026-11-11","sourceUpdated":"2026-11-11T19:50:29.708Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-0326","references":[{"url":"https://security.paloaltonetworks.com/CVE-2026-0326"}],"tags":["cve.org"],"ingestedAt":"2026-11-11T20:20:43.494Z","epss":0.00426,"epssPercentile":0.37327,"slug":"CVE-2026-0326","body":"## Overview\n\nA buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption.\n\n\n\nPanorama and Prisma® Access are not affected by this vulnerability.\n\n## Affected\n\n- `cloud_ngfw All`\n- `PAN-OS >= 12.2.0 < 12.2.4-h2`\n- `PAN-OS >= 12.1.0 < 12.1.10-h4`\n- `PAN-OS >= 11.2.0 < 11.2.16-h2`\n- `PAN-OS >= 11.1.0 < 11.1.16-h5`\n- `prisma_access`\n\n## Remediation\n\nVERSION           MINOR VERSION               SUGGESTED SOLUTION\nCloud NGFW                                    Customers who prefer to upgrade can work with Palo Alto\n                                              Networks support to schedule an on-demand software upgrade.\nPAN-OS 12.2       12.2.0 through 12.2.4-h*    Upgrade to 12.2.4-h2 or later.\nPAN-OS 12.1       12.1.0 through 12.1.10-h*   Upgrade to 12.1.10-h4 or later.\nPAN-OS 11.2       11.2.0 through 11.2.16-h*   Upgrade to 11.2.16-h2 or later.\nPAN-OS 11.1       11.1.0 through 11.1.16-h*   Upgrade to 11.1.16-h5 or later.\nAll older                                     Upgrade to a supported fixed version.\nunsupported\nPAN-OS versions\nPrisma Access                                 No action needed.\n\n### Workarounds\n\nCustomers can mitigate the risk of this issue by taking the following actions.\n\nDetach the SCTP Protection profile from active Security Policy rules allowing SCTP traffic.\n\nDisable configured DNS proxy objects:\n\n * Navigate to Network > DNS Proxy (https://docs.paloaltonetworks.com/ngfw/help/10-1/network/network-dns-proxy).\n\n * Click on each configured DNS Proxy object.\n\n * Uncheck the Enable checkbox.\n\n * Click OK and Commit the changes.\n\nUpdate any active OSPFv3 Auth Profiles under Network > Network Profiles > OSPFv3 Auth (https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing/create-ospfv3-routing-profiles)  to use standard cryptographic authentication other than ESP-NULL.","depth":"sunlit","depthScore":9,"depthScoreParts":{"impact":9.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}