EUVD-2026-42672
GHSA-8r6w-7h78-4w2j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Amber
Network-accessible, no auth required, no interaction; impact is solely high availability loss with no confidentiality or integrity effect.
Primary rating from Vendor (paloaltonetworks).
CVSS VectorVendor: paloaltonetworks
Lifecycle Timeline
3DescriptionCVE.org
Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.
Panorama is not impacted by these vulnerabilities.
AnalysisAI
Denial of service conditions in Palo Alto Networks PAN-OS allow unauthenticated network attackers to crash firewall dataplane processes by sending specially crafted traffic to or through a dataplane interface. Repeated exploitation escalates the impact: the firewall is forced into maintenance mode, effectively taking the security appliance offline and disrupting all traffic enforcement. No public exploit code has been identified at time of analysis, and Panorama management infrastructure is explicitly confirmed unaffected.
Technical ContextAI
PAN-OS is the operating system powering Palo Alto Networks Next-Generation Firewalls (NGFW) and PA-Series appliances. The dataplane interface is the high-speed packet-processing layer responsible for traffic inspection, policy enforcement, and session management - distinct from the management plane. CWE-754 (Improper Check for Unusual or Exceptional Conditions) indicates the root cause: the PAN-OS dataplane does not properly validate or handle malformed or edge-case network input, causing process crashes or resource exhaustion when exceptional packet structures are encountered. The plural 'multiple vulnerabilities' in the description suggests several distinct code paths in the dataplane share this flaw class.
RemediationAI
The primary remediation is to apply the PAN-OS patch versions identified in the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0287. Exact fix versions are not confirmed in the available data and must be sourced directly from that advisory. As a compensating control prior to patching, restrict network access to dataplane interfaces using upstream ACLs or out-of-band filtering to limit which source IPs can send traffic to or through the affected interfaces - note this may not be feasible for internet-facing firewalls performing perimeter enforcement and could reduce legitimate traffic reach. Enabling Zone Protection profiles to rate-limit or drop malformed packet types at ingress zones may reduce exposure. Monitor for unexpected firewall maintenance mode events as an indicator of exploitation attempts.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today