EUVD-2026-30064
GHSA-xqxf-q4xj-jxh3
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Red
Primary rating from Vendor (palo_alto) · only source for this CVE.
CVSS VectorVendor: palo_alto
Lifecycle Timeline
4DescriptionCVE.org
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.
Panorama, Cloud NGFW, and Prisma® Access are not impacted by these vulnerabilities.
AnalysisAI
Remote code execution and denial-of-service in Palo Alto Networks PAN-OS software stems from a buffer overflow in the IKEv2 processing path, allowing unauthenticated network attackers to either crash the firewall or run arbitrary code with elevated privileges. The flaw affects multiple PAN-OS branches (11.1.x, 11.2.x, and 12.1.x) while Panorama, Cloud NGFW, and Prisma Access remain unaffected. There is no public exploit identified at time of analysis, EPSS sits at a low 0.06% (19th percentile), and CISA SSVC currently lists exploitation as 'none'.
Technical ContextAI
The vulnerability lies in PAN-OS's IKEv2 (Internet Key Exchange version 2) implementation, which is used to negotiate IPSec VPN tunnels - typically on the firewall's external interface and exposed via UDP/500 and UDP/4500. The CWE-787 (Out-of-Bounds Write) classification indicates that a malformed IKEv2 packet causes the parser to write past the bounds of an allocated buffer, corrupting adjacent memory. Because IKEv2 is processed pre-authentication (the protocol itself negotiates authentication), this memory corruption is reachable without credentials. The affected CPEs span pan-os, cloud_ngfw, and prisma_access, but Palo Alto's advisory explicitly excludes the latter two - the CPE breadth appears to reflect NVD enumeration rather than actual exposure.
RemediationAI
Vendor-released patch: upgrade to PAN-OS 11.1.15, 11.2.12, or 12.1.7 (or the corresponding hotfixed maintenance releases such as 11.1.13-h5, 11.1.10-h25, 11.2.10-h6, 11.2.7-h13, or 12.1.4-h5) per the Palo Alto advisory at https://security.paloaltonetworks.com/CVE-2026-0263. As an interim compensating control where patching cannot be performed immediately, disable IKEv2 / IPSec VPN on the firewall's untrusted interfaces or restrict UDP/500 and UDP/4500 ingress to known peer IP addresses via an upstream ACL - note this will break site-to-site VPNs and remote-access IPSec clients, so it is only acceptable as a short-term measure. Avoid exposing the management plane to coincident risk by reviewing management-interface ACLs while patching.
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access t
Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote
A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with Glob
GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted F
Remote code execution in Palo Alto Networks PAN-OS User-ID Authentication Portal (Captive Portal) allows unauthenticated
Buffer overflow in the management web interface in Palo Alto Networks PAN-OS before 5.0.20, 5.1.x before 5.1.13, 6.0.x b
Authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS allows remote attackers to es
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Palo Alto Networks PAN-OS management interface contains an authenticated file read vulnerability allowing reading of fil
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today