PAN-OS: Denial of Service Vulnerability

published 2026-10-14 25 d ago modified 2026-10-15 24 d ago also EUVD-2026-101665

cvss: 1.2; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits: 0; none known

A denial of service vulnerability in Palo Alto Networks PAN-OS software enables an authenticated user with a read-only administrator role to cause a denial of service (DoS) condition by sending a specially crafted API request.

The security risk posed by this issue is significantly minimized by restricting access to the management web interface to only trusted internal IP addresses according to our recommended best practice deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 .

Cloud NGFW, Panorama, and Prisma® Access are not affected by this vulnerability.

Patch / fix

fixed in 1

Palo Alto Networks PAN-OS 11.1.16-h3, 11.2.16, 12.1.10-h2, 12.2.4

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 24 d ago (2026-10-15)

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	1.2	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/AU:N/R:A/V:D/RE:L/U:Amber
CNA	4.0	1.2	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:L/U:Amber

Affected products

Palo Alto Networks Cloud NGFW
Palo Alto Networks PAN-OS
Palo Alto Networks Prisma Access

Classification

Weakness

CWE-754 Improper Check for Unusual or Exceptional Conditions

Technology feeds

Palo Alto PAN-OS rss critical rss

References

security.paloaltonetworks.com /CVE-2026-0317
vendor-advisory

Sources

CVE List CVE-2026-0317
NVD CVE-2026-0317

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary