Palo Alto Networks PAN-OS: Denial of Service via Buffer Overflow (CVE-2026-0329)
A buffer overflow vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated network attacker to trigger a denial of service condition when specific IKE Gateway or DNS Proxy configurations are present.
CVE search metadata
CVE search record: CVE-2026-0329. KEV: no. Product: PAN-OS (10.2, 11.1, 11.2, 12.1, 12.2), Prisma Access (10.2, 11.2, 12.1). Brief: Palo Alto Networks PAN-OS: Denial of Service via Buffer Overflow (CVE-2026-0329). Brief link: https://feed.craftedsignal.io/briefs/2026-11-pan-os-buffer-overflow-cve-2026-0329/
Triage facts
Revision 1- Applicability
- PAN-OS (10.2, 11.1, 11.2, 12.1, 12.2), Prisma Access (10.2, 11.2, 12.1)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 21:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Unlikely
Palo Alto Networks has disclosed a buffer overflow vulnerability (CVE-2026-0329) in PAN-OS software. An unauthenticated attacker with network access can cause a denial of service (DoS) by sending specially crafted network traffic to or through a dataplane interface. This issue does not affect Cloud NGFW or Panorama. Exploitation requires specific configurations to be present, specifically an active IKE Gateway using certificate-based authentication with CRL or OCSP revocation enabled, or an active DNS Proxy object.
Impact
Successful exploitation results in a denial of service condition affecting the availability of the targeted firewall device. Palo Alto Networks reports no known exploitation in the wild.
Recommendation
- Upgrade affected PAN-OS installations to the specified fixed versions listed in the vendor advisory.
- If immediate patching is not possible, disable CRL and OCSP revocation checking on active IKE Gateways and disable configured DNS Proxy objects.
- Utilize the provided Threat IDs 510051 and 510052 for customers with active Threat Prevention subscriptions, noting that this requires SSL decryption for traffic directed to the management interface.
Immediate actions
Inventory all internet-facing PAN-OS and Prisma Access appliances to identify systems running vulnerable versions.
Upgrade vulnerable appliances to the resolved versions documented in the vendor advisory.
Threat Hunt
Identify spikes or recurring patterns of malformed network traffic directed at dataplane interfaces by monitoring for unexpected system resource exhaustion or process crashes associated with IKE Gateway or DNS Proxy components.
Data: PAN-OS System Logs, Traffic Logs, Threat Logs, Netflow
Mitigations
Disable CRL/OCSP revocation checking on active IKE Gateways and disable DNS Proxy objects if patching cannot be performed immediately.
CVE-2026-0329