EUVD-2026-42681
GHSA-g5c5-368c-hr8j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:M/U:Amber
AT:P maps to AC:H; scope changes to subsequent systems (S:C) with low C/I impact; no direct firewall impact.
Primary rating from Vendor (paloaltonetworks).
CVSS VectorVendor: paloaltonetworks
Lifecycle Timeline
2DescriptionCVE.org
An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services.
Cloud NGFW and Panorama are not impacted by this vulnerability.
AnalysisAI
Security policy bypass in Palo Alto Networks PAN-OS exposes protected services behind the firewall to traffic that should be blocked, exploitable by unauthenticated remote attackers via crafted IPv6 packets targeting the dataplane. The CVSS 4.0 score of 1.7 reflects that direct impact on the firewall itself is nil (VC:N/VI:N/VA:N), with only low-severity downstream effect on subsequent systems (SC:L/SI:L), and specific attack conditions must be present (AT:P). No public exploit code exists and no active exploitation has been reported (E:U), though the automatable flag (AU:Y) indicates the attack could in principle be scripted once conditions are met.
Technical ContextAI
PAN-OS is Palo Alto Networks' operating system for its Next-Generation Firewalls (NGFW), and the vulnerability resides specifically in the dataplane - the hardware-accelerated packet processing engine responsible for real-time security policy enforcement. CWE-131 (Incorrect Calculation of Buffer Size) points to a flaw in how the dataplane measures or allocates memory when handling IPv6 packet data, which likely causes certain IPv6 flows to be evaluated incorrectly or not at all by the policy engine, resulting in a bypass. The vulnerability is scoped exclusively to on-premises PAN-OS deployments; the advisory explicitly confirms that Cloud NGFW and Panorama (the centralized management plane) are not affected, meaning the attack surface is limited to hardware and VM-series firewalls running PAN-OS.
RemediationAI
Consult the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0280 for the specific patched PAN-OS version, which was not included in the available intelligence data - no exact fix version can be cited without independent confirmation from the advisory. As a compensating control while awaiting patch deployment, operators should evaluate whether IPv6 processing can be disabled or restricted on affected interfaces if IPv6 is not operationally required, as the vulnerability is specific to IPv6 packet handling in the dataplane. Additionally, segmenting management access and ensuring IPv6 traffic from untrusted networks does not reach NGFW dataplane interfaces can reduce exposure. Note that disabling IPv6 may disrupt environments with legitimate IPv6 routing dependencies.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to exe
A reflected cross-site scripting (XSS) vulnerability exists in the PAN-OS management web interface. Rated high severity
The device-management command-line interface in Palo Alto Networks PAN-OS before 3.1.12, 4.0.x before 4.0.10, and 4.1.x
The DNS Proxy in Palo Alto Networks PAN-OS before 6.1.18, 7.x before 7.0.16, 7.1.x before 7.1.11, and 8.x before 8.0.3 a
Same weakness CWE-131 – Incorrect Calculation of Buffer Size
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today