CVE-2026-0326: Palo Alto Networks PAN-OS buffer overflow in protocol and service processing

CVE-2026-0326 · Severity: info · Published 2026-11-11

A buffer overflow vulnerability in Palo Alto Networks PAN-OS, the operating system for their enterprise firewalls, allows an unauthenticated attacker to crash critical firewall processes or corrupt memory. This can temporarily disrupt network protection by taking the firewall offline. The attack requires specific configurations to be enabled: SCTP protocol, DNS proxy, or OSPFv3 routing on IPv6 interfaces.

Technologies: Palo Alto Networks PAN-OS. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0326 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-0326 being exploited in the wild.
How severe is CVE-2026-0326?
Informational severity, published 11 November 2026.
Which products and versions are affected?
Palo Alto Networks PAN-OS 12.2.0 through 12.2.4-h1; 12.1.0 through 12.1.10-h3; 11.2.0 through 11.2.16-h1; 11.1.0 through 11.1.16-h4; older unsupported versions.
Is there a fix for CVE-2026-0326?
Yes: fixed in PAN-OS 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5. Until then: Disable SCTP by unchecking SCTP Security in Device > Setup > Management > General Settings, and detach SCTP Protection profiles from active security policy rules. Disable DNS proxy objects by navigating to Network > DNS Proxy and unchecking the Enable checkbox on each configured object. For OSPFv3, update active OSPFv3 Auth Profiles to use standard cryptographic authentication instead of ESP-NULL. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0326 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-0326?
Check whether you run Palo Alto Networks PAN-OS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: PAN-OS 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, 11.1.16-h5

Disable SCTP by unchecking SCTP Security in Device > Setup > Management > General Settings, and detach SCTP Protection profiles from active security policy rules. Disable DNS proxy objects by navigating to Network > DNS Proxy and unchecking the Enable checkbox on each configured object. For OSPFv3, update active OSPFv3 Auth Profiles to use standard cryptographic authentication instead of ESP-NULL.

Technical details

A CWE-787 out-of-bounds write vulnerability exists in PAN-OS protocol and service processing, triggered via network attack vectors (SCTP, DNS proxy, or OSPFv3) without authentication or user interaction. An unauthenticated attacker can cause service process crashes or memory corruption, resulting in denial of service. Fixes are available in PAN-OS 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, and 11.1.16-h5.

Affected products

  • Palo Alto Networks PAN-OS 12.2.0 through 12.2.4-h1; 12.1.0 through 12.1.10-h3; 11.2.0 through 11.2.16-h1; 11.1.0 through 11.1.16-h4; older unsupported versions

Timeline

  • 2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.