Palo Alto PAN-OS CVE-2026-0263

The firewall must be running an affected PAN-OS version (11.1.x < 11.1.15, 11.2.x < 11.2.12, or 12.1.x < 12.1.7) with IKEv2 processing reachable - i.e., IPSec VPN configured with IKEv2 on an interface accessible to the attacker, typically the untrusted/internet-facing interface listening on UDP/500 and UDP/4500. No authentication is required (PR:N) and no user interaction (UI:N), but CVSS 4.0 AC:H plus AU:Y indicate the exploit requires specific attack preconditions - likely a particular memory state, packet sequence, or timing window for the buffer overflow primitive to yield code execution rather than only a crash. Panorama, Cloud NGFW, and Prisma Access deployments are NOT exploitable per vendor. Limiting factors: high attack complexity reduces opportunistic mass exploitation, and firewalls without any IKEv2/IPSec VPN configuration are out of scope.

Signals are notably divergent. CVSS 4.0 rates this 7.2 with AV:N/PR:N/UI:N (network, unauthenticated, no user interaction) and VC:H/VI:H/VA:H (full confidentiality, integrity, availability impact), but AC:H (high attack complexity) and AU:Y (attack requirements present) indicate exploitation is non-trivial - likely requiring specific timing, memory layout, or environmental conditions. CISA SSVC concurs with 'Automatable: no' and 'Exploitation: none'. EPSS is very low at 0.06%, no KEV listing, and no public PoC. The vendor (Palo Alto) self-reported, which is typical of an internally discovered issue without observed in-the-wild abuse. Realistic risk: high impact if successfully exploited (firewall takeover would be catastrophic), but the practical bar for weaponization is currently high. Patch priority should still be elevated for any internet-exposed firewall with IKEv2/IPSec VPN enabled because the asset is security-critical and pre-auth reachable.

An attacker scans the internet for Palo Alto firewalls with IKEv2 listeners exposed (UDP/500, UDP/4500), then sends a specially crafted IKEv2 negotiation packet that triggers an out-of-bounds write in the parser. Successful exploitation either crashes the firewall (DoS, breaking perimeter security and VPN connectivity) or yields arbitrary code execution at elevated privileges on the firewall data plane. No public exploit identified at time of analysis, and CVSS AC:H indicates the memory-corruption primitive likely requires non-trivial heap grooming or precondition setup.