Skip to content
Threat Feed
Subscribe
medium advisory

Palo Alto Networks PAN-OS: Sensitive Information Disclosure (CVE-2026-0331)

An unauthenticated remote information disclosure vulnerability in PAN-OS allows attackers to exfiltrate firewall and session data via the dataplane interface.

CVE search metadata

CVE search record: CVE-2026-0331. KEV: no. Product: PAN-OS (< 12.2.4-h2), PAN-OS (< 12.1.4-h14), PAN-OS (< 12.1.7-h12), PAN-OS (< 12.1.10-h4), PAN-OS (< 11.2.4-h24), PAN-OS (< 11.2.7-h24), PAN-OS (< 11.2.10-h18), PAN-OS (< 11.2.13-h5), PAN-OS (< 11.2.16-h2), PAN-OS (< 11.1.4-h39), PAN-OS (< 11.1.6-h41), PAN-OS (< 11.1.7-h13), PAN-OS (< 11.1.10-h37), PAN-OS (< 11.1.13-h17), PAN-OS (< 11.1.16-h5), PAN-OS (< 10.2.7-h40), PAN-OS (< 10.2.10-h43), PAN-OS (< 10.2.13-h28), PAN-OS (< 10.2.16-h13), PAN-OS (< 10.2.18-h14), Prisma Access (< 12.1.10-h4), Prisma Access (< 11.2.7-h24), Prisma Access (< 10.2.10-h43), Cloud NGFW (All). Brief: Palo Alto Networks PAN-OS: Sensitive Information Disclosure (CVE-2026-0331). Brief link: https://feed.craftedsignal.io/briefs/2026-11-panos-disclosure-cve-2026-0331/

Triage facts

Revision 1
Applicability
PAN-OS (< 12.2.4-h2), PAN-OS (< 12.1.4-h14) +22
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 11, 21:54 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely

Palo Alto Networks has disclosed a sensitive information disclosure vulnerability (CVE-2026-0331) in PAN-OS software. The vulnerability allows an unauthenticated remote attacker with network access to retrieve sensitive firewall and session information by sending crafted traffic to or through a dataplane interface. No special configuration is required for exposure, and the impact is higher on PA-Series and VM-Series firewalls. Panorama is not affected by this vulnerability.

Impact

Successful exploitation may allow for the exfiltration of sensitive information, including session-related data, which could facilitate further reconnaissance or network compromise. Palo Alto Networks has confirmed that the impact is lower for Prisma Access, as it requires an authenticated user and restricted external access.

Recommendation

  • Upgrade all affected PA-Series and VM-Series firewalls to the specified patched versions immediately.
  • For Prisma Access and Cloud NGFW, coordinate with Palo Alto Networks Support for scheduled maintenance or on-demand upgrades.
  • Inventory all currently deployed PAN-OS instances across the environment to identify systems running vulnerable versions.

Immediate actions

Inventory all PAN-OS instances and identify versions falling within the affected ranges.

Network Security 48h

Threat Hunt

Identify anomalous or high-frequency traffic directed at firewall dataplane interfaces that originates from external or untrusted network segments, focusing on requests that deviate from normal administrative or service-oriented traffic patterns.

T1592 medium medium confidence hunt now

Data: PAN-OS Traffic Logs, NetFlow logs

Mitigations

Upgrade PAN-OS and Prisma Access software to the fixed versions identified in the Palo Alto Networks advisory.

immediate IT Operations

CVE-2026-0331

Gaps

  • Lack of specific Snort or IDS signatures for detecting the exploitation traffic.