# CVE-2026-0321: Palo Alto Networks PAN-OS denial of service in network services

Source: https://junglewise.ai/threats/cve-2026-0321-denial-of-service-vulnerabilities-in-palo-alto-networks-pan-os  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-0321 · Severity: info · Published 2026-10-14

Palo Alto Networks PAN-OS is the operating system for enterprise firewalls that protect corporate networks and data. An attacker with network access can send crafted network traffic to a firewall to cause temporary service disruption or force the firewall into maintenance mode, blocking traffic and requiring manual intervention to restore operations.

Technologies: [Palo Alto Networks PAN-OS](https://junglewise.ai/threats/technologies/pan-os), [Palo Alto Networks Prisma Access](https://junglewise.ai/threats/technologies/prisma-access), [Siemens Ruggedcom Ape1808](https://junglewise.ai/threats/technologies/ruggedcom-ape1808). Vendors: [Palo Alto Networks](https://junglewise.ai/threats/vendors/palo-alto-networks), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-0321 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0321 being exploited in the wild.

**How severe is CVE-2026-0321?** Informational severity, published 14 October 2026.

**Which products and versions are affected?** Palo Alto Networks PAN-OS 12.2 before 12.2.4; 12.1 before 12.1.4-h12, 12.1.7-h8, 12.1.10-h2; 11.2 before 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16; 11.1 before 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3; 10.2 before 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Palo Alto Networks Prisma Access 12.1 before 12.1.7-h8; 11.2 before 11.2.7-h21; 10.2 before 10.2.10-h41; Siemens Ruggedcom Ape1808 all versions with Palo Alto Networks Virtual NGFW.

**Is there a fix for CVE-2026-0321?** Yes: fixed in PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Prisma Access 12.1.7-h8, 11.2.7-h21, 10.2.10-h41. Until then: Customers with Threat Prevention subscription can enable limited protection by activating Threat ID 510038 (available in Applications and Threats content version 9158-10284 and later), though this requires SSL Decryption to be active. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0321 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-0321?** Check whether you run Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access or Siemens Ruggedcom Ape1808 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in PAN-OS 12.2.4, 12.1.4-h12, 12.1.7-h8, 12.1.10-h2, 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16, 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3, 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12; Prisma Access 12.1.7-h8, 11.2.7-h21, 10.2.10-h41

Customers with Threat Prevention subscription can enable limited protection by activating Threat ID 510038 (available in Applications and Threats content version 9158-10284 and later), though this requires SSL Decryption to be active.

## Technical details

Multiple denial of service vulnerabilities in PAN-OS allow an unauthenticated attacker with network access to crash or disable network services by sending specially crafted packets to a dataplane interface. Repeated exploitation forces the firewall into maintenance mode. The vulnerability is in network service handling (CWE-754 improper exception handling) and requires only network access with no authentication or user interaction.

## Affected products

- Palo Alto Networks PAN-OS 12.2 before 12.2.4; 12.1 before 12.1.4-h12, 12.1.7-h8, 12.1.10-h2; 11.2 before 11.2.4-h22, 11.2.7-h21, 11.2.10-h15, 11.2.13-h3, 11.2.16; 11.1 before 11.1.4-h37, 11.1.6-h39, 11.1.7-h11, 11.1.10-h35, 11.1.13-h15, 11.1.16-h3; 10.2 before 10.2.7-h38, 10.2.10-h41, 10.2.13-h26, 10.2.16-h11, 10.2.18-h12
- Palo Alto Networks Prisma Access 12.1 before 12.1.7-h8; 11.2 before 11.2.7-h21; 10.2 before 10.2.10-h41
- Siemens RUGGEDCOM APE1808 all versions with Palo Alto Networks Virtual NGFW

## Timeline

- 2026-10-14: disclosed

## References

- [https://security.paloaltonetworks.com/CVE-2026-0321](https://security.paloaltonetworks.com/CVE-2026-0321)
- [https://cert-portal.siemens.com/productcert/html/ssa-104023.html](https://cert-portal.siemens.com/productcert/html/ssa-104023.html)

## Related threats

- [Palo Alto Networks PAN-OS information disclosure via dataplane interface](https://junglewise.ai/threats/cve-2026-0331-an-information-disclosure-vulnerability-in-palo-alto-networks-pan)
- [Palo Alto Networks PAN-OS buffer overflow denial of service](https://junglewise.ai/threats/cve-2026-0329-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os)
- [Palo Alto Networks PAN-OS authentication bypass in GlobalProtect](https://junglewise.ai/threats/cve-2026-0328-authentication-bypass-vulnerabilities-in-the-globalprotect-portal)
- [Palo Alto Networks PAN-OS privilege escalation in GlobalProtect](https://junglewise.ai/threats/cve-2026-0327-a-privilege-escalation-vulnerability-in-the-globalprotect-gateway)
- [Palo Alto Networks PAN-OS buffer overflow in protocol and service processing](https://junglewise.ai/threats/cve-2026-0326-a-buffer-overflow-vulnerability-in-palo-alto-networks-pan-os)