PAN-OS CVE-2026-0321

Exploitation requires network reachability to a PAN-OS dataplane interface - the attacker must be able to send traffic to or through (i.e., transiting) such an interface, so exposure depends on whether the dataplane interface is reachable by the attacker (e.g., internet-facing or otherwise attacker-adjacent). No authentication and no user interaction are required (PR:N/UI:N). Causing the persistent maintenance-mode outcome requires repeated triggering, not a single packet. Key limiting factors: Cloud NGFW and Panorama are explicitly not affected; the impact is availability-only with no data exposure or code execution; and exploitation is confined to deployments where a dataplane interface is actually reachable by the attacker.

This is a medium-severity denial-of-service issue (vendor CVSS 4.0 base 6.6) affecting Palo Alto Networks PAN-OS. The CVSS 4.0 vector is internally consistent with the description: AV:N/AC:L/AT:N/PR:N/UI:N indicates a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, and the impact profile VC:N/VI:N/VA:H correctly reflects a pure availability impact with no confidentiality or integrity loss - matching a DoS in which the firewall is driven into maintenance mode. The exploit maturity metric E:U (Unproven) aligns with the absence of any POC or KEV signal in the provided intelligence, so this is best characterized as no public exploit identified at time of analysis; it is not confirmed actively exploited. There is no EPSS value supplied in the input, so exploitation probability cannot be quantified here. The real-world priority is moderate rather than acute: the attack is unauthenticated and network-triggerable (which raises concern for internet-facing or dataplane-exposed firewalls), but the ceiling is availability-only, the attack is not automatable into code execution, and no weaponized exploit is known. One note of caution: the input provides only the vendor CVSS 4.0 vector and no CVSS 3.1 vector or EPSS, so cross-signal comparison is limited to the vendor's own framing - treat the quantitative risk as vendor-asserted and verify against the vendor advisory.

An unauthenticated attacker with network access sends specially crafted traffic to or through a PAN-OS dataplane interface, causing a denial-of-service condition on the firewall. By repeating the trigger, the attacker forces the firewall into maintenance mode, disrupting all traffic the device protects. No public exploit code is known at the time of analysis, and exploit maturity is rated Unproven (E:U).