PAN-OS (< 12.2.4-H2, < 12.1.10-H4, < 11.2.16-H2, < 11.1.16-H5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pan-os--12.2.4-h2--12.1.10-h4--11.2.16-h2--11.1.16-h5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 21:53:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPalo Alto Networks PAN-OS: Buffer Overflow Vulnerability (CVE-2026-0326)https://feed.craftedsignal.io/briefs/2026-11-pan-os-buffer-overflow-cve-2026-0326/Wed, 11 Nov 2026 21:53:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pan-os-buffer-overflow-cve-2026-0326/A buffer overflow vulnerability in Palo Alto Networks PAN-OS allows an unauthenticated attacker to cause a service process crash or memory corruption when specific features like SCTP, DNS proxy, or OSPFv3 are enabled.A buffer overflow vulnerability (CWE-787) in Palo Alto Networks PAN-OS software allows an unauthenticated, remote attacker to cause a service process crash or potential memory corruption. The vulnerability is triggered under specific conditions: when SCTP is enabled, when a DNS proxy object is configured and enabled on the firewall, or when OSPFv3 routing is enabled on an IPv6 interface using weak authentication (ESP-NULL). Palo Alto Networks confirmed this was discovered internally and there is no evidence of active exploitation.

Impact

Successful exploitation results in a service process crash or potential memory corruption on the affected firewall. This primarily impacts service availability. Panorama and Prisma Access are not affected.

Recommendation

  • Upgrade PAN-OS to the specified fixed versions immediately: 12.2.4-h2, 12.1.10-h4, 11.2.16-h2, or 11.1.16-h5.
  • For Cloud NGFW, coordinate with support for an on-demand upgrade.
  • If patching is not immediately feasible, mitigate the risk by detaching SCTP protection profiles, disabling unused DNS proxy objects, and reconfiguring OSPFv3 authentication profiles to avoid ESP-NULL settings.
]]>lowadvisorycve-2026-0326network-securityvulnerability