---
id: CVE-2026-0326
title: 'PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing'
summary: >-
  A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables
  an unauthenticated attacker to disrupt service processing by causing a service
  process crash or memory corruption.




  Panorama and Prisma® Access are not affec…
severity: low
cvss: 1.7
cvssVector: >-
  CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber
cvssSource: cna
cwe:
  - CWE-787
vendor: Palo Alto Networks
product: Cloud NGFW
affected:
  - cloud_ngfw All
  - PAN-OS >= 12.2.0 < 12.2.4-h2
  - PAN-OS >= 12.1.0 < 12.1.10-h4
  - PAN-OS >= 11.2.0 < 11.2.16-h2
  - PAN-OS >= 11.1.0 < 11.1.16-h5
  - prisma_access
published: '2026-11-11'
updated: '2026-11-11'
sourceUpdated: '2026-11-11T19:50:29.708Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-0326'
references:
  - url: 'https://security.paloaltonetworks.com/CVE-2026-0326'
tags:
  - cve.org
ingestedAt: '2026-11-11T20:20:43.494Z'
epss: 0.00426
epssPercentile: 0.37327
---

## Overview

A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption.



Panorama and Prisma® Access are not affected by this vulnerability.

## Affected

- `cloud_ngfw All`
- `PAN-OS >= 12.2.0 < 12.2.4-h2`
- `PAN-OS >= 12.1.0 < 12.1.10-h4`
- `PAN-OS >= 11.2.0 < 11.2.16-h2`
- `PAN-OS >= 11.1.0 < 11.1.16-h5`
- `prisma_access`

## Remediation

VERSION           MINOR VERSION               SUGGESTED SOLUTION
Cloud NGFW                                    Customers who prefer to upgrade can work with Palo Alto
                                              Networks support to schedule an on-demand software upgrade.
PAN-OS 12.2       12.2.0 through 12.2.4-h*    Upgrade to 12.2.4-h2 or later.
PAN-OS 12.1       12.1.0 through 12.1.10-h*   Upgrade to 12.1.10-h4 or later.
PAN-OS 11.2       11.2.0 through 11.2.16-h*   Upgrade to 11.2.16-h2 or later.
PAN-OS 11.1       11.1.0 through 11.1.16-h*   Upgrade to 11.1.16-h5 or later.
All older                                     Upgrade to a supported fixed version.
unsupported
PAN-OS versions
Prisma Access                                 No action needed.

### Workarounds

Customers can mitigate the risk of this issue by taking the following actions.

Detach the SCTP Protection profile from active Security Policy rules allowing SCTP traffic.

Disable configured DNS proxy objects:

 * Navigate to Network > DNS Proxy (https://docs.paloaltonetworks.com/ngfw/help/10-1/network/network-dns-proxy).

 * Click on each configured DNS Proxy object.

 * Uncheck the Enable checkbox.

 * Click OK and Commit the changes.

Update any active OSPFv3 Auth Profiles under Network > Network Profiles > OSPFv3 Auth (https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing/create-ospfv3-routing-profiles)  to use standard cryptographic authentication other than ESP-NULL.