Prisma SD-WAN ION EUVD-2026-30135

Exploitation requires the attacker to be network-adjacent to the target Prisma SD-WAN ION device - specifically positioned on the same Layer 2 broadcast domain, VLAN, or directly connected network segment, as confirmed by CVSS 4.0 AV:A. No authentication is required (PR:N) and no user interaction is needed (UI:N). IPv6 must be enabled and reachable on the target ION interface, as the vulnerability is triggered via a crafted IPv6 packet. The SSVC 'automatable: no' determination confirms that the adjacency prerequisite prevents automated internet-scale scanning. Exploitation is limited to actors with physical or logical network proximity to the ION appliance, which in most SD-WAN deployments means branch LAN access, a compromised on-premises host, or a rogue device with physical switch port access.

The overall risk profile is moderate-low for most deployments. CVSS 4.0 scores this at 4.9 (Medium), with the adjacency requirement (AV:A) being the primary limiter - internet-based mass exploitation is not possible. The CVSS 4.0 supplemental vector reinforces this: E:U (unproven exploit maturity), R:U (user recovery required, not automatic restart), V:D (diffuse value density), and U:Amber (limited urgency). EPSS at 0.03% (9th percentile) confirms very low community-observed exploitation probability. SSVC corroborates: exploitation none, automatable no, technical impact partial. The VA:H component indicates a full availability disruption to the vulnerable ION device itself, while SA:L indicates only minor downstream availability impact to dependent systems. The non-automatable SSVC finding is consistent with the adjacency requirement, which prevents large-scale scanning-based exploitation. The primary real-world risk scenario is an insider threat, a compromised device on the same LAN segment, or an attacker who has already achieved adjacency through a prior compromise. No KEV listing, no POC, and no active exploitation signals are present.

An attacker with access to the same network segment as a Prisma SD-WAN ION device - such as a compromised host on a branch LAN or a rogue device plugged into the same switch - crafts a malformed IPv6 packet designed to trigger an unbounded loop condition in the ION's IPv6 processing stack. Upon receipt of the packet, the ION device enters a resource-exhausted state causing a system disruption, potentially dropping all SD-WAN traffic for the affected branch. No public exploit code exists and no active exploitation has been observed at time of analysis.