EUVD-2026-42672
GHSA-8r6w-7h78-4w2j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed PAN-OS dataplane interface
-
DeliveryCraft malformed/exceptional network packets
-
ExploitSend repeated traffic to dataplane
-
ExecutionTrigger CWE-754 improper condition handling
-
PersistExhaust dataplane process
-
ImpactFirewall enters maintenance mode
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
|
| Exploitation Conditions | The attacker must have network-level reachability to a PAN-OS dataplane interface - either directly (internet-facing deployment) or from an adjacent network segment. No authentication is required. No special feature configuration is needed beyond standard firewall operation with active dataplane interfaces. Exploitation is limited to PAN-OS firewalls (PA-Series, VM-Series, CN-Series running PAN-OS); Panorama is explicitly confirmed unaffected. The impact requires repeated attempts to reach the maintenance mode state; a single attempt may produce transient disruption only. Internet-facing deployments with exposed dataplane interfaces face the highest realistic risk. |
| Impact | The CVSS 4.0 score of 6.6 (Medium) reflects the limited impact scope - only availability is affected (VA:H), with no confidentiality or integrity impact on either the vulnerable or subsequent systems. However, the real-world severity for network defenders is higher than the numeric score implies: a firewall entering maintenance mode is a complete security enforcement outage, not merely degraded service. The attack requires no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L) over the network (AV:N), making it highly accessible to opportunistic attackers. The E:U modifier indicates no known exploit code as of the advisory date, and U:Amber suggests limited/targeted utility. EPSS data is not provided. Absent KEV listing, widespread exploitation is not confirmed, but the trivial exploitation prerequisites make this a credible availability threat for any internet-exposed PAN-OS dataplane interface. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to a PAN-OS dataplane interface crafts and sends specially structured network packets designed to trigger unhandled exceptional conditions in the dataplane processing pipeline. A single interaction may cause a service disruption; repeated delivery of such traffic forces the firewall into maintenance mode, taking the appliance fully offline and creating a network security gap that the attacker or a coordinated party can exploit for lateral movement. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Denial of service conditions in Palo Alto Networks PAN-OS allow unauthenticated network attackers to crash firewall dataplane processes by sending specially crafted traffic to or through a dataplane interface. Repeated exploitation escalates the impact: the firewall is forced into maintenance mode, effectively taking the security appliance offline and disrupting all traffic enforcement. No public exploit code has been identified at time of analysis, and Panorama management infrastructure is explicitly confirmed unaffected.
RemediationAI
The primary remediation is to apply the PAN-OS patch versions identified in the Palo Alto Networks security advisory at https://security.paloaltonetworks.com/CVE-2026-0287. Exact fix versions are not confirmed in the available data and must be sourced directly from that advisory. As a compensating control prior to patching, restrict network access to dataplane interfaces using upstream ACLs or out-of-band filtering to limit which source IPs can send traffic to or through the affected interfaces - note this may not be feasible for internet-facing firewalls performing perimeter enforcement and could reduce legitimate traffic reach. Enabling Zone Protection profiles to rate-limit or drop malformed packet types at ingress zones may reduce exposure. Monitor for unexpected firewall maintenance mode events as an indicator of exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PAN-OS is the operating system powering Palo Alto Networks Next-Generation Firewalls (NGFW) and PA-Series appliances. The dataplane interface is the high-speed packet-processing layer responsible for traffic inspection, policy enforcement, and session management - distinct from the management plane. CWE-754 (Improper Check for Unusual or Exceptional Conditions) indicates the root cause: the PAN-OS dataplane does not properly validate or handle malformed or edge-case network input, causing process crashes or resource exhaustion when exceptional packet structures are encountered. The plural 'multiple vulnerabilities' in the description suggests several distinct code paths in the dataplane share this flaw class.
Know when Pan Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:C/RE:M/U:Amber
Network-accessible, no auth required, no interaction; impact is solely high availability loss with no confidentiality or integrity effect.
Primary rating from Vendor (paloaltonetworks).
CVSS VectorVendor: paloaltonetworks
Lifecycle Timeline
2DescriptionCVE.org
Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode.
Panorama is not impacted by these vulnerabilities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Authenticated attackers holding high-privilege administrative access to the PAN-OS management interface can execute arbi
Exploit-DB