At a glance
- CVE-2026-0329 is an out-of-bounds write in PAN-OS that can cause denial of service.
- Impact depends on IKE Gateway or DNS Proxy configuration; the vendor has not observed malicious exploitation.
- Check the version and upgrade to the applicable fixed release; the vendor also lists mitigations.
Palo Alto PAN-OS: Address CVE-2026-0329, a flaw that can disrupt service
Palo Alto Networks warns that CVE-2026-0329 in PAN-OS is an out-of-bounds write that could let a remote attacker cause denial of service under specific configuration conditions. Check the affected version and configuration, then upgrade to the applicable fixed release.
In this article
Palo Alto Networks has warned of CVE-2026-0329 in PAN-OS, the operating system running on its firewall devices. This article covers the exposure conditions, versions to address, and actions specified in the official advisory.
Overview and technical details
The out-of-bounds write could allow an unauthenticated attacker with network access to send specially crafted traffic to or through the dataplane interface and cause denial of service. Palo Alto Networks rates the severity MEDIUM and urgency MODERATE.
| Field | Details |
|---|---|
| Product | PAN-OS |
| Identifiers | CVE-2026-0329; CWE-787 (Out-of-bounds Write); CAPEC-100 (Overflow Buffers) |
| CVSS | CVSS-BT 4.6; CVSS-B 8.2 |
| Exploit maturity | UNREPORTED |
Affected systems
Exposure requires either an active IKE Gateway using certificate authentication with CRL or OCSP revocation checking enabled, or a configured and enabled DNS Proxy object. For the PAN-OS branches below, upgrade to the corresponding fixed release or a later release in that branch.
| Product/branch | Affected versions | Fixed release |
|---|---|---|
| PAN-OS 12.2 | < 12.2.4-h2 | 12.2.4-h2 or later |
| PAN-OS 12.1 | < 12.1.4-h14, < 12.1.7-h12, or < 12.1.10-h4 | 12.1.4-h14, 12.1.7-h12, or 12.1.10-h4, respectively, or later |
| PAN-OS 11.2 | < 11.2.4-h24, < 11.2.7-h24, < 11.2.10-h18, < 11.2.13-h5, or < 11.2.16-h2 | Corresponding branch fix or 11.2.16-h2 or later |
| PAN-OS 11.1 | < 11.1.4-h39, < 11.1.6-h41, < 11.1.7-h13, < 11.1.10-h37, < 11.1.13-h17, or < 11.1.16-h5 | Corresponding branch fix or 11.1.16-h5 or later |
| PAN-OS 10.2 | < 10.2.7-h40, < 10.2.10-h43, < 10.2.13-h28, < 10.2.16-h13, or < 10.2.18-h14 | Corresponding branch fix or 10.2.18-h14 or later |
| Unsupported older PAN-OS | Older versions that are no longer supported | Upgrade to a supported, fixed version |
| Prisma Access 12.1 | 12.1.2 through 12.1.10-h* | 12.1.10-h4 or later |
| Prisma Access 11.2 | 11.2.0 through 11.2.7-h* | 11.2.7-h24 or later |
| Prisma Access 10.2 | 10.2.0 through 10.2.10-h* | 10.2.10-h43 or later |
Cloud NGFW and Panorama are not affected. PAN-OS versions at or above the applicable fixed release, and Prisma Access versions at or above the applicable fixed release, are considered unaffected.
Exploitation status
Palo Alto Networks says it has not observed malicious exploitation of this issue. Exploit Maturity is listed as UNREPORTED.
System checks
Check the PAN-OS version running on the device with this command:
show system infoCompare the displayed version with the applicable branch and fixed release in the affected systems table. A version below the fixed threshold needs an upgrade.
Remediation and mitigation
Upgrade PAN-OS or Prisma Access to the applicable fixed version for the branch in use.
For Prisma Access, Palo Alto Networks says it will upgrade customers in the next maintenance window. Customers needing an earlier upgrade can contact Support or their account team to request a separately scheduled upgrade.
For Threat Prevention subscribers, enable Threat ID
510051and510052from Applications and Threats content version9171-10349or later. This mitigation requires SSL Decryption; enabling Threat Prevention for traffic to the management service; decrypting traffic to the management interface; replacing the Certificate for Inbound Traffic Management; and routing traffic to the MGT port through a DP port, for example by enabling a management profile on the DP interface.Another mitigation is to disable Use CRL and Use OCSP in the Certificate Profile attached to the active IKE Gateway, or disable configured DNS Proxy objects. Click OK and Commit the changes.
Related articles
CVE-2026-123039 exploited on Check Point products: prioritize remediation by November 16
CISA added CVE-2026-123039 to KEV after confirming active exploitation of a permissions flaw in multiple Check Point products running Gaia OS. An authenticated local user may run commands as root; assess exposure, conduct forensic triage and follow CISA guidance by the November 16, 2026 KEV…
Palo Alto PAN-OS: Patch CVE-2026-0325 IP address limit bypass
Palo Alto Networks warns that CVE-2026-0325 in the PAN-OS GlobalProtect gateway lets users with valid credentials bypass IP address limits and source-IP-based access controls. Check gateway configuration and upgrade affected branches to their corresponding fixed versions.
FortiOS SSLVPN certificate validation flaw: check affected versions and upgrade
Fortinet disclosed CVE-2026-121528, an improper certificate validation flaw in FortiOS SSLVPN that may let an unauthenticated remote attacker perform a Man-in-the-Middle attack. Check affected branches and upgrade to a fixed release.
Fortinet warns of CVE-2026-126254 in FortiOS and FortiSASE; upgrade affected systems
Fortinet warns that CVE-2026-126254 in the FortiOS and FortiSASE BGP daemon could cause denial of service. The flaw has CVSSv3 9.6 and requires a configured iBGP neighbor. Check versions and upgrade FortiOS or move affected FortiSASE branches to a fixed release.