EUVD-2026-30064
GHSA-xqxf-q4xj-jxh3
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Red
Primary rating from Vendor (palo_alto) · only source for this CVE.
CVSS VectorVendor: palo_alto
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Red
Lifecycle Timeline
4DescriptionCVE.org
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.
Panorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.
AnalysisAI
Remote code execution and denial-of-service in Palo Alto Networks PAN-OS software stems from a buffer overflow in the IKEv2 processing path, allowing unauthenticated network attackers to either crash the firewall or run arbitrary code with elevated privileges. The flaw affects multiple PAN-OS branches (11.1.x, 11.2.x, and 12.1.x) while Panorama, Cloud NGFW, and Prisma Access remain unaffected. There is no public exploit identified at time of analysis, EPSS sits at a low 0.06% (19th percentile), and CISA SSVC currently lists exploitation as 'none'.
Technical ContextAI
The vulnerability lies in PAN-OS's IKEv2 (Internet Key Exchange version 2) implementation, which is used to negotiate IPSec VPN tunnels - typically on the firewall's external interface and exposed via UDP/500 and UDP/4500. The CWE-787 (Out-of-Bounds Write) classification indicates that a malformed IKEv2 packet causes the parser to write past the bounds of an allocated buffer, corrupting adjacent memory. Because IKEv2 is processed pre-authentication (the protocol itself negotiates authentication), this memory corruption is reachable without credentials. The affected CPEs span pan-os, cloud_ngfw, and prisma_access, but Palo Alto's advisory explicitly excludes the latter two - the CPE breadth appears to reflect NVD enumeration rather than actual exposure.
RemediationAI
Vendor-released patch: upgrade to PAN-OS 11.1.15, 11.2.12, or 12.1.7 (or the corresponding hotfixed maintenance releases such as 11.1.13-h5, 11.1.10-h25, 11.2.10-h6, 11.2.7-h13, or 12.1.4-h5) per the Palo Alto advisory at https://security.paloaltonetworks.com/CVE-2026-0263. As an interim compensating control where patching cannot be performed immediately, disable IKEv2 / IPSec VPN on the firewall's untrusted interfaces or restrict UDP/500 and UDP/4500 ingress to known peer IP addresses via an upstream ACL - note this will break site-to-site VPNs and remote-access IPSec clients, so it is only acceptable as a short-term measure. Avoid exposing the management plane to coincident risk by reviewing management-interface ACLs while patching.
More in Cloud Ngfw
View allAuthentication bypass in Palo Alto Networks PAN-OS allows unauthenticated network attackers to circumvent authentication
Heap-based buffer overflow in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS allows unauthenticated
Denial of service conditions in Palo Alto Networks PAN-OS allow unauthenticated network attackers to crash firewall data
Multiple denial-of-service conditions in Palo Alto Networks PAN-OS allow unauthenticated remote attackers to crash or de
Command injection in Palo Alto Networks PAN-OS enables an authenticated administrator to escape system-enforced restrict
Multiple command injection vulnerabilities in Palo Alto Networks PAN-OS allow an authenticated administrator to escape s
Privilege escalation in Palo Alto Networks PAN-OS on PA-Series and VM-Series firewalls and Panorama appliances allows an
Server-side request forgery in the IKEv2 implementation of Palo Alto Networks PAN-OS allows unauthenticated remote attac
Memory corruption in PAN-OS tunnel traffic processing allows an authenticated, adjacent-network attacker to force the fi
Stored cross-site scripting in Palo Alto Networks PAN-OS® web interface allows a malicious authenticated administrator t
Stored cross-site scripting in Palo Alto Networks PAN-OS allows a malicious authenticated administrator to persist a Jav
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today