# CVE-2026-0310: Palo Alto Networks PAN-OS buffer overflow in XML processing

Source: https://junglewise.ai/threats/cve-2026-0310-palo-alto-networks-pan-os-buffer-overflow-in-xml-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-0310 · Severity: info · CVSS 7.2 · Published 2026-09-10

Palo Alto Networks PAN-OS is the operating system for enterprise firewalls that protect networks from unauthorized access and threats. A buffer overflow vulnerability in XML processing allows unauthenticated attackers with network access to cause service outages on VM-Series firewalls or execute malicious code with full system privileges on PA-Series hardware firewalls. This affects critical network infrastructure that organizations rely on to defend their networks.

Technologies: [Palo Alto Networks Cloud NGFW](https://junglewise.ai/threats/technologies/cloud-ngfw), [Palo Alto Networks Panorama](https://junglewise.ai/threats/technologies/panorama), [Palo Alto Networks Prisma Access](https://junglewise.ai/threats/technologies/prisma-access). Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks).

## Quick answers

**Is CVE-2026-0310 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0310 being exploited in the wild.

**How severe is CVE-2026-0310?** Informational severity, with a CVSS score of 7.2, published 10 September 2026.

**Which products and versions are affected?** Palo Alto Networks Cloud NGFW Multiple versions affected; Palo Alto Networks Panorama Multiple versions affected; Palo Alto Networks Prisma Access 10.2.0–10.2.x, 11.2.0–11.2.x, 12.1.2–12.1.x.

**Is there a fix for CVE-2026-0310?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-0310 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-0310?** Check whether you run Palo Alto Networks Cloud NGFW, Palo Alto Networks Panorama or Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a CWE-787 out-of-bounds write (buffer overflow) in the XML processing functionality of PAN-OS. The vulnerability is triggered when parsing specially crafted XML input on either the management web interface or dataplane interface. No authentication or special configuration is required for exploitation, and the attack complexity is rated as high. On PA-Series hardware firewalls, successful exploitation enables arbitrary code execution with root privileges; on VM-Series virtual firewalls, it results in denial of service. Panorama centralized management systems are also affected. Patches are available for all supported versions across PAN-OS 10.2, 11.1, 11.2, and 12.1/12.2 branches, as well as Prisma Access and Cloud NGFW deployments.

## Affected products

- Palo Alto Networks PAN-OS 10.2.0–10.2.18, 11.1.0–11.1.16, 11.2.0–11.2.13, 12.1.2–12.1.9
- Palo Alto Networks Panorama Multiple versions affected
- Palo Alto Networks Prisma Access 10.2.0–10.2.x, 11.2.0–11.2.x, 12.1.2–12.1.x
- Palo Alto Networks Cloud NGFW Multiple versions affected

## Timeline

- 2026-09-09: disclosed: CVE-2026-0310 published by Palo Alto Networks
- 2026-09-10: other: Advisory published to NVD

## References

- [https://security.paloaltonetworks.com/CVE-2026-0310](https://security.paloaltonetworks.com/CVE-2026-0310)

## Related threats

- [Palo Alto Networks PAN-OS information disclosure via dataplane interface](https://junglewise.ai/threats/cve-2026-0331-an-information-disclosure-vulnerability-in-palo-alto-networks-pan)
- [Palo Alto Networks PAN-OS buffer overflow denial of service](https://junglewise.ai/threats/cve-2026-0329-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os)
- [Palo Alto Networks PAN-OS privilege escalation in GlobalProtect](https://junglewise.ai/threats/cve-2026-0327-a-privilege-escalation-vulnerability-in-the-globalprotect-gateway)
- [Palo Alto Networks PAN-OS GlobalProtect authorization bypass](https://junglewise.ai/threats/cve-2026-0325-an-authorization-bypass-vulnerability-in-the-globalprotect-gateway)
- [Palo Alto Networks PAN-OS authenticated admin command injection](https://junglewise.ai/threats/cve-2026-0320-a-command-injection-vulnerability-in-palo-alto-networks-pan-os)