CVE-2026-0329: Palo Alto Networks PAN-OS buffer overflow denial of service

CVE-2026-0329 · Severity: info · Published 2026-11-11

A buffer overflow vulnerability in Palo Alto Networks PAN-OS firewalls allows an unauthenticated attacker with network access to crash the firewall and cause a denial of service. The vulnerability affects firewalls with specific certificate authentication or DNS proxy configurations. Exploitation requires no user interaction and can be triggered by sending specially crafted network packets, potentially disrupting network security and availability.

Technologies: Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0329 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-0329 being exploited in the wild.
How severe is CVE-2026-0329?
Informational severity, published 11 November 2026.
Which products and versions are affected?
Palo Alto Networks PAN-OS 10.2.0 through 10.2.18-h13, 11.1.0 through 11.1.16-h4, 11.2.0 through 11.2.16-h1, 12.1.2 through 12.1.10-h3, 12.2.0 through 12.2.4-h1; Palo Alto Networks Prisma Access 10.2.0 through 10.2.10-h42, 11.2.0 through 11.2.7-h23, 12.1.2 through 12.1.10-h3.
Is there a fix for CVE-2026-0329?
Yes: fixed in PAN-OS 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14, 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5, 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2, 12.1.4-h14, 12.1.7-h12, 12.1.10-h4, 12.2.4-h2; Prisma Access 10.2.10-h43, 11.2.7-h24, 12.1.10-h4. Until then: Customers with a Threat Prevention subscription can enable Threat IDs 510051 and 510052 (from Applications and Threats content version 9171-10349 and later) for limited protection. Disable DNS Proxy or IKE Gateway certificate-based authentication with CRL/OCSP revocation checking if not required. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0329 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-0329?
Check whether you run Palo Alto Networks PAN-OS or Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: PAN-OS 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14, 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5, 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2, 12.1.4-h14, 12.1.7-h12, 12.1.10-h4, 12.2.4-h2; Prisma Access 10.2.10-h43, 11.2.7-h24, 12.1.10-h4

Customers with a Threat Prevention subscription can enable Threat IDs 510051 and 510052 (from Applications and Threats content version 9171-10349 and later) for limited protection. Disable DNS Proxy or IKE Gateway certificate-based authentication with CRL/OCSP revocation checking if not required.

Technical details

A CWE-787 out-of-bounds write vulnerability in PAN-OS enables unauthenticated network-based denial of service via specially crafted packets sent to or through dataplane interfaces. Exploitation requires either an IKE Gateway with certificate-based authentication and CRL/OCSP revocation checking enabled, or a configured and enabled DNS Proxy object. The vulnerability causes system unavailability but does not result in confidentiality or integrity compromise.

Affected products

  • Palo Alto Networks PAN-OS 10.2.0 through 10.2.18-h13, 11.1.0 through 11.1.16-h4, 11.2.0 through 11.2.16-h1, 12.1.2 through 12.1.10-h3, 12.2.0 through 12.2.4-h1
  • Palo Alto Networks Prisma Access 10.2.0 through 10.2.10-h42, 11.2.0 through 11.2.7-h23, 12.1.2 through 12.1.10-h3

Timeline

  • 2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.