EUVD-2026-36145
GHSA-v62p-f565-pfxr
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:Amber
Adjacent vector for tunnel-interface-adjacent requirement, low privilege for authenticated user, unchanged scope, availability-only impact with no confidentiality or integrity effects.
Primary rating from Vendor (palo_alto).
CVSS VectorVendor: palo_alto
Lifecycle Timeline
2DescriptionCVE.org
A memory corruption vulnerability in the processing of tunnel traffic in Palo Alto Networks PAN-OS® software allows an authenticated user to initiate system reboots using a maliciously crafted packet. Repeated attempts to initiate a reboot causes the firewall to enter maintenance mode.
Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.
AnalysisAI
Memory corruption in PAN-OS tunnel traffic processing allows an authenticated, adjacent-network attacker to force the firewall into unplanned reboots or maintenance mode via a crafted packet, constituting a denial-of-service against the firewall itself. The CVSS 4.0 vector (AV:A/PR:L/VA:H) confirms the impact is purely availability - no confidentiality or integrity loss - and exploitation requires both authenticated access and adjacency to the tunnel interface. No public exploit code exists and no active exploitation has been reported; the vendor-assigned threat metric (E:U) reinforces that real-world risk is presently low.
Technical ContextAI
PAN-OS is Palo Alto Networks' operating system for its Next-Generation Firewall (NGFW) appliances, responsible for processing tunneled traffic (e.g., IPSec, GRE, or proprietary tunnel protocols). The assigned CWE-754 (Improper Check for Unusual or Exceptional Conditions) indicates the root cause is a failure to properly validate or handle exceptional input states within the tunnel packet parsing path, which triggers memory corruption. Notably, the vulnerability tag includes 'Buffer Overflow' (CWE-120), which conflicts with the assigned CWE-754 - the true root cause classification should be verified with the vendor advisory. The CPE data lists cpe:2.3:a:palo_alto_networks:pan-os as affected, while the description explicitly excludes Panorama, Cloud NGFW, and Prisma Access, creating a discrepancy with the CPE strings that also enumerate those products.
RemediationAI
Consult the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0269 for exact patched PAN-OS version numbers; no specific fix version was available in the data at time of analysis. As a compensating control pending patching, restrict authenticated access to the firewall management plane and tunnel interfaces to the minimum necessary set of trusted users and systems, reducing the pool of potential authenticated attackers. Additionally, monitor for anomalous tunnel traffic patterns or unexpected system reboots as indicators of exploitation attempts. The supplemental CVSS remediation effort metric (RE:M) suggests a moderate patching effort, and the recovery metric (R:A) suggests automatic recovery after reboot - implying temporary rather than permanent disruption if exploited without a patch in place.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today