{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pan-os--12.2.4-h2--12.1.10-h4--11.2.16-h2--11.1.16-h5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-0326"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PAN-OS (\u003c 12.2.4-h2, \u003c 12.1.10-h4, \u003c 11.2.16-h2, \u003c 11.1.16-h5)","Cloud NGFW"],"_cs_severities":["low"],"_cs_tags":["cve-2026-0326","network-security","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Palo Alto Networks"],"content_html":"\u003cp\u003eA buffer overflow vulnerability (CWE-787) in Palo Alto Networks PAN-OS software allows an unauthenticated, remote attacker to cause a service process crash or potential memory corruption. The vulnerability is triggered under specific conditions: when SCTP is enabled, when a DNS proxy object is configured and enabled on the firewall, or when OSPFv3 routing is enabled on an IPv6 interface using weak authentication (ESP-NULL). Palo Alto Networks confirmed this was discovered internally and there is no evidence of active exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a service process crash or potential memory corruption on the affected firewall. This primarily impacts service availability. Panorama and Prisma Access are not affected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade PAN-OS to the specified fixed versions immediately: 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, or 11.1.16-h5.\u003c/li\u003e\n\u003cli\u003eFor Cloud NGFW, coordinate with support for an on-demand upgrade.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, mitigate the risk by detaching SCTP protection profiles, disabling unused DNS proxy objects, and reconfiguring OSPFv3 authentication profiles to avoid ESP-NULL settings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T21:53:56Z","date_published":"2026-11-11T21:53:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pan-os-buffer-overflow-cve-2026-0326/","summary":"A buffer overflow vulnerability in Palo Alto Networks PAN-OS allows an unauthenticated attacker to cause a service process crash or memory corruption when specific features like SCTP, DNS proxy, or OSPFv3 are enabled.","title":"Palo Alto Networks PAN-OS: Buffer Overflow Vulnerability (CVE-2026-0326)","url":"https://feed.craftedsignal.io/briefs/2026-11-pan-os-buffer-overflow-cve-2026-0326/"}],"language":"en","title":"CraftedSignal Threat Feed - PAN-OS (\u003c 12.2.4-H2, \u003c 12.1.10-H4, \u003c 11.2.16-H2, \u003c 11.1.16-H5)","version":"https://jsonfeed.org/version/1.1"}