# CVE-2026-0329: PAN-OS: Buffer Overflow Vulnerability Status: published. Published: 2026-11-11. Updated: 2026-11-11. A buffer overflow vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Cloud NGFW and Panorama are not affected by this vulnerability. ## Remediation - fix: VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW No action needed. PAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h2 or later. PAN-OS 12.1 12.1.8 through 12.1.10-h* Upgrade to 12.1.10-h4 or later. 12.1.5 through 12.1.7-h* Upgrade to 12.1.7-h12 or later. 12.1.2 through 12.1.4-h* Upgrade to 12.1.4-h14 or later. PAN-OS 11.2 11.2.15 through 11.2.16-h* Upgrade to 11.2.16-h2 or later. 11.2.11 through 11.2.13-h* Upgrade to 11.2.13-h5 or 11.2.16-h2 or later. 11.2.8 through 11.2.10-h* Upgrade to 11.2.10-h18 or 11.2.16-h2 or later. 11.2.5 through 11.2.7-h* Upgrade to 11.2.7-h24 or 11.2.16-h2 or later. 11.2.0 through 11.2.4-h* Upgrade to 11.2.4-h24 or 11.2.16-h2 or later. PAN-OS 11.1 11.1.14 through 11.1.16-h* Upgrade to 11.1.16-h5 or later. 11.1.11 through 11.1.13-h* Upgrade to 11.1.13-h17 or 11.1.16-h5 or later. 11.1.8 through 11.1.10-h* Upgrade to 11.1.10-h37 or 11.1.16-h5 or later. 11.1.7 through 11.1.7-h* Upgrade to 11.1.7-h13 or 11.1.16-h5 or later. 11.1.5 through 11.1.6-h* Upgrade to 11.1.6-h41 or 11.1.16-h5 or later. 11.1.0 through 11.1.4-h* Upgrade to 11.1.4-h39 or 11.1.16-h5 or later. PAN-OS 10.2 10.2.17 through 10.2.18-h* Upgrade to 10.2.18-h14 or later. 10.2.14 through 10.2.16-h* Upgrade to 10.2.16-h13 or 10.2.18-h14 or later. 10.2.11 through 10.2.13-h* Upgrade to 10.2.13-h28 or 10.2.18-h14 or later. 10.2.8 through 10.2.10-h* Upgrade to 10.2.10-h43 or 10.2.18-h14 or later. 10.2.0 through 10.2.7-h* Upgrade to 10.2.7-h40 or 10.2.18-h14 or later. All older Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access 12.1 12.1.2 through 12.1.10-h* Upgrade to 12.1.10-h4 or later. Prisma Access 11.2 11.2.0 through 11.2.7-h* Upgrade to 11.2.7-h24 or later. Prisma Access 10.2 10.2.0 through 10.2.10-h* Upgrade to 10.2.10-h43 or later. * See the note under Product Status for information regarding Prisma Access upgrades. (source: CNA: palo_alto) - workaround: Customers with a Threat Prevention subscription are provided with limited coverage against this vulnerability by enabling Threat ID 510051 and 510052 (from Applications and Threats content version 9171-10349 and later). For these Threat IDs to protect against attacks for this vulnerability: * Route incoming traffic for the MGT port through a DP port (https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id59206398-3dab-4b2f-9b4b-7ea500d036ba), e.g., enabling management profile on a DP interface for management access. * Replace the Certificate for Inbound Traffic Management (https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#id112f7714-8995-4496-bbf9-781e63dec71c). * Decrypt inbound traffic to the management interface so the firewall can inspect it. (https://docs.paloaltonetworks.com/best-practices/10-1/administrative-access-best-practices/administrative-access-best-practices/deploy-administrative-access-best-practices#idbbd82587-17a2-42b4-9245-d3714e1e13a2) * Enable threat prevention on the inbound traffic to management services. Please note that this Threat ID requires SSL Decryption. Customers can mitigate the risk of this issue by taking the following actions. Disable CRL and OCSP Revocation Checking: * Navigate to Device > Certificate Management > Certificate Profile (https://docs.paloaltonetworks.com/ngfw/help/10-2/device/device-certificate-management-certificate-profile). * Click on the Certificate Profile assigned to the active IKE Gateway. * Uncheck Use CRL. * Uncheck Use OCSP. * Click OK and Commit the changes. Disable configured DNS proxy objects: * Navigate to Network > DNS Proxy (https://docs.paloaltonetworks.com/ngfw/help/10-1/network/network-dns-proxy). * Click on each configured DNS Proxy object. * Uncheck the Enable checkbox. * Click OK and Commit the changes. (source: CNA: palo_alto) ## Affected products and versions - Palo Alto Networks / Cloud NGFW: All (unaffected, custom). Source: CNA: palo_alto - Palo Alto Networks / PAN-OS: ≥ 12.2.0; < 12.2.4-h2 (affected, custom); unaffected at 12.2.4-h2; ≥ 12.1.0; < 12.1.10-h4 (affected, custom); unaffected at 12.1.10-h4; unaffected at 12.1.7-h12; unaffected at 12.1.4-h14; ≥ 11.2.0; < 11.2.16-h2 (affected, custom); unaffected at 11.2.16-h2; unaffected at 11.2.13-h5; unaffected at 11.2.10-h18; unaffected at 11.2.7-h24; unaffected at 11.2.4-h24; ≥ 11.1.0; < 11.1.16-h5 (affected, custom); unaffected at 11.1.16-h5; unaffected at 11.1.13-h17; unaffected at 11.1.10-h37; unaffected at 11.1.7-h13; unaffected at 11.1.6-h41; unaffected at 11.1.4-h39; ≥ 10.2.0; < 10.2.18-h14 (affected, custom); unaffected at 10.2.18-h14; unaffected at 10.2.16-h13; unaffected at 10.2.13-h28; unaffected at 10.2.10-h43; unaffected at 10.2.7-h40. Source: CNA: palo_alto - Palo Alto Networks / Prisma Access: ≥ 12.1.0; < 12.1.10-h4 (affected, custom); unaffected at 12.1.10-h4; ≥ 11.2.0; < 11.2.7-h24 (affected, custom); unaffected at 11.2.7-h24; ≥ 10.2.0; < 10.2.10-h43 (affected, custom); unaffected at 10.2.10-h43. Source: CNA: palo_alto ## Severity and prioritization - CVSS 4.0: 4.6 (medium); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber; source: CNA: palo_alto - CISA KEV: No listing in collected sources - EPSS: Not available - SSVC: Not available - Weaknesses: CWE-787 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://security.paloaltonetworks.com/CVE-2026-0329 (CNA: palo_alto; vendor-advisory) ## Provenance - CNA: palo_alto: https://www.cve.org/CVERecord?id=CVE-2026-0329; retrieved 2026-11-11; source updated 2026-11-11 Revision: 6d29ee95af30b314fcf6af2f60b59844570b4a27c43f32181954728cd1705a32 Canonical: https://y2.dev/cve/CVE-2026-0329 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.