CVE-2026-0331: Palo Alto Networks PAN-OS information disclosure via dataplane interface

CVE-2026-0331 · Severity: info · Published 2026-11-11

An unauthenticated remote attacker can obtain sensitive firewall and session information from Palo Alto Networks PAN-OS firewalls by sending crafted traffic to or through a dataplane interface. This information disclosure could expose details that aid in reconnaissance or further attacks on the protected network. Cloud NGFW deployments receive automatic patching; on-premises firewalls require manual upgrades.

Technologies: Palo Alto Networks Cloud NGFW, Palo Alto Networks PAN-OS, Palo Alto Networks Prisma Access. Vendors: Palo Alto Networks.

Quick answers

Is CVE-2026-0331 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-0331 being exploited in the wild.
How severe is CVE-2026-0331?
Informational severity, published 11 November 2026.
Which products and versions are affected?
Palo Alto Networks Cloud NGFW All versions; Palo Alto Networks PAN-OS 10.2.0–10.2.18-h13; 11.1.0–11.1.16-h4; 11.2.0–11.2.16-h1; 12.1.0–12.1.10-h3; 12.2.0–12.2.4-h1; Palo Alto Networks Prisma Access 10.2.0–10.2.10-h42; 11.2.0–11.2.7-h23; 12.1.0–12.1.10-h3.
Is there a fix for CVE-2026-0331?
Yes: fixed in PAN-OS 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14; 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5; 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2; 12.1.4-h14, 12.1.7-h12, 12.1.10-h4; 12.2.4-h2. Cloud NGFW: automatic upgrade. Prisma Access 10.2.10-h43, 11.2.7-h24, 12.1.10-h4.. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-0331 attacked?
It is attacked over the network.
Am I affected by CVE-2026-0331?
Check whether you run Palo Alto Networks Cloud NGFW, Palo Alto Networks PAN-OS or Palo Alto Networks Prisma Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: PAN-OS 10.2.7-h40, 10.2.10-h43, 10.2.13-h28, 10.2.16-h13, 10.2.18-h14; 11.1.4-h39, 11.1.6-h41, 11.1.7-h13, 11.1.10-h37, 11.1.13-h17, 11.1.16-h5; 11.2.4-h24, 11.2.7-h24, 11.2.10-h18, 11.2.13-h5, 11.2.16-h2; 12.1.4-h14, 12.1.7-h12, 12.1.10-h4; 12.2.4-h2. Cloud NGFW: automatic upgrade. Prisma Access 10.2.10-h43, 11.2.7-h24, 12.1.10-h4.

Technical details

An information disclosure vulnerability in PAN-OS allows unauthenticated remote attackers to extract sensitive firewall configuration and session state via network access to dataplane interfaces. The vulnerability affects PA-Series and VM-Series firewalls (CVSS 8.7 base); Prisma Access is less severely affected as it requires authenticated user access (CVSS 6.9 base). No configuration changes or prerequisites are required for exposure.

Affected products

  • Palo Alto Networks PAN-OS 10.2.0–10.2.18-h13; 11.1.0–11.1.16-h4; 11.2.0–11.2.16-h1; 12.1.0–12.1.10-h3; 12.2.0–12.2.4-h1
  • Palo Alto Networks Cloud NGFW All versions
  • Palo Alto Networks Prisma Access 10.2.0–10.2.10-h42; 11.2.0–11.2.7-h23; 12.1.0–12.1.10-h3

Timeline

  • 2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.