PAN-OS CVE-2026-0262

Network-level access to the PAN-OS firewall is required (AV:N); no authentication is needed (PR:N per CVSS 4.0 vector). No special non-default configuration is required on the firewall itself (AT:N - no attack requirements). Exploitation is limited to PAN-OS 10.2, 11.1, 11.2, and 12.1 version ranges on hardware and virtual NGFW appliances, and to Prisma Access on the 10.2 and 11.2 tracks. Panorama deployments and Cloud NGFW are explicitly excluded by the vendor advisory. SSVC Automatable:no indicates that while no privileges or configuration prerequisite is needed, reliable exploitation requires deliberate traffic crafting and is not trivially scriptable for mass scanning. No user interaction is required (UI:N). The scope of impact is limited to the vulnerable system's own availability (subsequent system metrics SC:N/SI:N/SA:N), meaning successful DoS does not provide a pivot point into adjacent systems.

The CVSS 4.0 base score of 6.6 reflects a network-accessible (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-user-interaction (UI:N) attack with high availability impact on the vulnerable system - a profile that would normally indicate elevated urgency. However, multiple converging signals significantly temper the real-world risk: EPSS sits at 0.05% (16th percentile), indicating very low observed exploitation probability relative to all scored CVEs; the CVSS 4.0 Exploit Maturity modifier is E:U (Unreported - no public exploit code); SSVC classifies exploitation as none and Automatable as no; and CISA KEV status is not confirmed. The SSVC Automatable:no finding is notable because it diverges from the AC:L CVSS assessment - this likely reflects that while individual exploit attempts are not technically complex, reliable mass exploitation or automated scanning is not straightforward, possibly requiring traffic tailored to specific protocol states. CVSS urgency is rated Amber (U:Amber), consistent with a scheduled remediation posture rather than emergency patching. Overall, this is a real vulnerability warranting timely patching within normal maintenance cycles, but evidence does not support treating it as an immediate incident-response priority.

An unauthenticated attacker with network-level access to a PAN-OS firewall sends one or more specially crafted packets designed to trigger unhandled exceptional conditions (CWE-754) in a specific protocol parser or traffic processing component. The targeted firewall process fails to gracefully handle the malformed input and crashes or enters an unresponsive state, causing a denial of service that disrupts firewall availability and, consequently, any network traffic it inspects or routes. No public exploit code has been identified at time of analysis, and SSVC Automatable:no suggests exploitation requires targeted traffic construction rather than generic scanning.