PAN-OS Panorama EUVD-2026-101636

Exploitation is limited to Palo Alto Networks Panorama (the centralized management appliance); Cloud NGFW, Prisma Access, and standalone PAN-OS firewalls are explicitly not affected, so the data plane is out of scope. The attacker must reach Panorama's log-processing functionality over the network and deliver crafted log data; the CVSS AT:P flag combined with the description's reference to 'repeated attempts' indicates the overflow is condition-dependent and must be triggered multiple times to force the maintenance-mode DoS rather than succeeding reliably on a single request. Limiting factors that reduce realistic risk: impact is availability-only (no code execution, data disclosure, or tampering indicated), recovery from maintenance mode requires manual administrator action (R:U), and the attack is rated not automatable (AU:N). Whether the sender must be an authorized/managed firewall feeding logs to Panorama is not specified in the available data and should be confirmed with the vendor advisory.

This is a moderate, availability-only issue rather than a top-tier emergency. The vendor CVSS 4.0 score is 4.6 (Medium) with vector AV:N/AC:L/AT:P/PR:N/UI:N and impact confined to availability (VC:N/VI:N/VA:H) - there is no confidentiality or integrity impact and no scope change to subsequent systems. The exploit-maturity metric is E:U (unproven), there is no CISA KEV listing and no public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' SSVC-style signals reinforce low urgency: AU:N (not automatable), R:U (recovery requires manual user action), V:D (diffuse value) and the vendor's own U:Amber urgency. The AT:P (attack requirements present) metric and the description's emphasis on 'repeated attempts' indicate the DoS is not trivially or reliably reproducible, further tempering real-world risk. The most important nuance is a scoping conflict in the input: the CPE list and Tags include Cloud NGFW and Prisma Access, but the description explicitly states those products and standalone PAN-OS firewalls are NOT affected - only Panorama is. Treat the CPE/tag coverage as over-broad and verify against the Palo Alto advisory. Net: a network-reachable, unauthenticated DoS against the Panorama management plane (not the firewall data plane) that is unproven in the wild - worth patching in normal cycles, not a drop-everything priority.

An attacker with network reachability to a Panorama appliance sends crafted log data to its log-processing functionality, triggering a stack-based buffer overflow that crashes the service. By repeatedly triggering the condition, the attacker drives Panorama into maintenance mode, disrupting centralized firewall management until an administrator manually recovers it. No public exploit code is known (E:U), and the CVSS AT:P flag plus 'repeated attempts' wording suggest the condition is not reliably reproducible on a single try.