PAN-OS CVE-2026-0269

Exploitation requires two concrete prerequisites: (1) the attacker must be authenticated to the PAN-OS system (PR:L - at minimum a low-privileged user account), and (2) the attacker must be on an adjacent network segment with the ability to send tunnel traffic to the firewall (AV:A). The specific trigger is the processing of maliciously crafted tunnel traffic packets, meaning the firewall must have tunnel processing active (e.g., an IPSec or other tunnel interface configured and operational). Limiting factors: remote unauthenticated exploitation is not possible given PR:L and AV:A constraints; Panorama, Cloud NGFW, and Prisma Access deployments are explicitly excluded; and no special elevated privileges beyond a valid authenticated session are required to trigger the flaw.

The CVSS 4.0 score of 4.6 (Medium) accurately reflects limited real-world priority. The adjacent network attack vector (AV:A) restricts the attacker pool to those with access to the same network segment as the firewall's tunnel interface - not arbitrary internet attackers. Low privilege requirement (PR:L) means an already-authenticated user is needed, further constraining the threat actor profile. The impact is limited to availability (VA:H) with no confidentiality or integrity exposure, meaning the worst-case outcome is firewall downtime or forced maintenance mode - serious in production environments but not a data breach scenario. The supplemental exploitation metric (E:U) confirms no public exploit code exists, and the vulnerability is not listed in CISA KEV. EPSS data was not provided; given the constrained attack conditions, exploitation probability is expected to be low. The primary risk is an insider threat or a compromised authenticated account targeting high-availability firewall deployments.

An authenticated attacker with access to the same network segment as a PAN-OS firewall's tunnel interface crafts a malformed tunnel packet designed to trigger the improper condition check in the tunnel traffic processor, causing memory corruption and an unplanned firewall reboot. Repeating this sequence of crafted packets in rapid succession forces the firewall to escalate into maintenance mode, taking it offline and disrupting all traffic it was inspecting or routing. No public proof-of-concept code has been identified, so exploitation requires independent vulnerability research or reverse engineering of the patch.