PAN-OS (10.2, 11.1, 11.2, 12.1, 12.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pan-os-10.2-11.1-11.2-12.1-12.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 21:53:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPalo Alto Networks PAN-OS: Denial of Service via Buffer Overflow (CVE-2026-0329)https://feed.craftedsignal.io/briefs/2026-11-pan-os-buffer-overflow-cve-2026-0329/Wed, 11 Nov 2026 21:53:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-pan-os-buffer-overflow-cve-2026-0329/A buffer overflow vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated network attacker to trigger a denial of service condition when specific IKE Gateway or DNS Proxy configurations are present.Palo Alto Networks has disclosed a buffer overflow vulnerability (CVE-2026-0329) in PAN-OS software. An unauthenticated attacker with network access can cause a denial of service (DoS) by sending specially crafted network traffic to or through a dataplane interface. This issue does not affect Cloud NGFW or Panorama. Exploitation requires specific configurations to be present, specifically an active IKE Gateway using certificate-based authentication with CRL or OCSP revocation enabled, or an active DNS Proxy object.

Impact

Successful exploitation results in a denial of service condition affecting the availability of the targeted firewall device. Palo Alto Networks reports no known exploitation in the wild.

Recommendation

  • Upgrade affected PAN-OS installations to the specified fixed versions listed in the vendor advisory.
  • If immediate patching is not possible, disable CRL and OCSP revocation checking on active IKE Gateways and disable configured DNS Proxy objects.
  • Utilize the provided Threat IDs 510051 and 510052 for customers with active Threat Prevention subscriptions, noting that this requires SSL decryption for traffic directed to the management interface.
]]>mediumadvisorycvedenial-of-servicenetwork-securityfirewall